Comment by buzer

Private cameras pointing to street can be lawful under GDPR, but in that case they are GDPR controller. That then requires them fulfill bunch of obligations which they probably aren't, e.g. giving proper Article 13 notice.

I don't know if it's criminal in any EU country, but it would be something that you could complain to DPA about. Or initiate civil lawsuit against the controller.

Worth noting is that in some cases the camera vendor might also be (joint) controller as they can determine means & purposes of the processing. If they are simply storing the video then it's unlikely, but if they for example use it for AI training that would likely bring them controller territory.