This is what I meant when I said it wouldn't be perfect. There are serious challenges, as you have pointed out.
In the case of kinect, perhaps small "friends and family" personal use databases could still be allowed. But large-scale databases (e.g. millions of faces) to recognize any person could be prohibited. This way, your xbox and whatever personal devices can recognize you for fun, but random strangers cannot.
Sure, but you now have to draw an exact line between "friends and family" and "large-scale database". It has to something watertight enough to work against companies with big legal teams too.
Also, what happens if I move my "friends and family" database to a cloud provider?
We could define a "friends and family" database as a device-local database limited to recognizing up to n people. Any database that can recognize > n people, or is made accessible over a network, would be prohibited. This would allow for your devices to be trained to recognize you, but prevent this information from being stored in aggregate within "the cloud".
You seem to assume that companies would be determined to circumvent the law. I am not convinced this is the case. For instance, I'm pretty sure Google and some other companies have actually held back certain face-based technologies simply because it's creepy, even in the absence of regulation. If US and EU law both prohibited massive-scale face recognition databases, I don't think Facebook and the like would be rushing to circumvent it. Are they really going to set up a server in Sealand or search for some elaborate loophole?
Finally, I just want to add that we won't be able to work out all the details within a single HN comment thread. Legislation in general is tricky and fraught with imperfections and tradeoffs. That doesn't mean it's not worth doing, or that it wouldn't be effective. If I had just proposed the idea that freedom of speech could be protected by law, it would be easy to find problems with that. But at the end of the day, the first amendment and so on is valuable and effective... in spite of any imperfections. So on the same note, I feel that privacy legislation, even though it's kind of a new thing with some issues, could be made to work.
There are certainly issues - wouldn't society benefit if the device could also recognize people on the FBI's Most Wanted list?
And then the train of government/media abuse starts rolling: Persons-of-interest sought by local law enforcement? Registered sex offenders? People on the No-Fly list? Shouldn't these devices support wiretapping such that they can recognize people as directed by LEO on a rubberstamp warrant?
In the case of kinect, perhaps small "friends and family" personal use databases could still be allowed. But large-scale databases (e.g. millions of faces) to recognize any person could be prohibited. This way, your xbox and whatever personal devices can recognize you for fun, but random strangers cannot.