One of the things we need to develop is a rough shape these laws should take, as it's not immediately apparent [0]. For starters - prohibiting ALPR/face recognition/anything else that turns standing video surveillance into personally identifiable information. Prohibiting city/town/state governments from setting these up on public property. Prohibiting corporate owned/controlled/backhauled cameras recording at any area that hasn't been expressly authorized by its owner/occupant. Statutory limits of retention times, and a requirement that all corporate users of surveillance cameras publish their locations and retention policy.
That's what I can think of off the top of my head. It's a thorny problem because there are longstanding uses of video surveillance that are mostly okay, while only sometimes abusive. The real sea change with "Flock" is the scale and the automation.
[0] whereas the way to approach tackling online surveillance is apparent - ie privacy legislation akin to the GDPR