Afaik the DPA is aimed at processing of data, specifically excludes that collected for security warranted or not, has no teeth to it, has no provision to force the publication of data held as a matter of course (opt in not opt out) and has afaik no case law regarding surveillance (it's mostly focused on internal data processing)

we should assume that if I can see a camera I can go to surveillance.gov.UK enter my lat long, choose the camera from a list and see the raw feed - wave at it. And see who has acessed that feed in the past hour.

If that os not a normal reflex for people waiting to catch thier train, or walking to the shops, then we have not got the right legislation