Making the possession of data this either illegal or too horribly cumbersome.

Flock is just an iteration, and getting rid of that brand won't fix it. And camera tracking of normal citizens is just an iteration -- not the underlying systemic issue that isn't being addressed.

The EU has GDPR. At this point, I want something stronger than that.

Still not enough. What you suggest does not prevent the government of possessing the data. Technical means of collection needs to be preemptively banned.