It's too late to regulate data harvesting, because we can't go back in time. However, we can regulate the use of technology.
What people don't always understand very clearly is that the idea driving the technologies we are talking about is acquiring lots of data and using it to train the systems. The desired outcome is facial recognition, meaning the ability to identify whether someone is such and such a person. It creates an explicit model. In technology and engineering, there is usually a data entry phase during which information is processed with a view to results. That's not the model here. Now, implicit models are created which, on the basis of observation, processing and the analysis of many data sets, can provide the expected results. The players who succeeded in doing that by collecting all kinds of data over the past 10 years now have a competitive advantage compared to these models. It's something that's very difficult to reproduce. They are true black boxes.
My view is that this would be extremely difficult, because you can't travel back in time.