Police and private companies should "immediately stop" the use of facial recognition surveillance, says a group of privacy campaigners.