2. Analyzing images for biometric markers and linking it to a database of persons can absolutely be legislated against.
3. One step further, utilizing biometric information for decision making is also very easy to legislate against.
Some companies might do these things secretly anyway, but then we have the need for audits and strong enforcement of the law, which is another matter. First step is to get this into legislation.