I've given a bit of thought on this, and I think the best path might be civil liability for the privacy loss-- defined broadly. Private security camera that never goes anywhere? You're fine. Start posting that same footage online where it results in people being massively tracked: big liability.

I think otherwise it's too difficult to define the exact boundary between harmful and harmless use-- instead it's better to say that if your use harms someone you'll regret it.