Similarly, we need rules about how our data can be combined with other data, and then bought and sold without our knowledge or consent.
Honestly, I think we've already got them. You can't make a movie about me without paying me unless I'm a public figure. If I'm a private figure or a semi-private figure you have to pay me. If you're going to make a movie about me, the public figure, you can only use imagery created through journalism.
If someone successfully argues that the indelible identity of a person, no matter what medium it is captured in, is that person's "likeness" they're already protected to the hilt by copyright law. Go after the money and the entire equation changes.