The GDPR is far from perfect, but it does cover this. It talks about acquiring and storing information that can be used to identify people. It doesn't specify what counts, so now that face recognition is pretty, it automatically applies to images.

It also talks about uses cases where such things are allowed to be recorded, and forbids all others.

> IMO it is much more practical to regulate and penalize the activity of using such a network than to preempt its creation.

Hard disagree. If such a network is created, foreign adversaries (or domestic ones that don't abide by the laws) can hack them. Has happened quite a number of times.