I believe GDPR does cover the security camera scenario, there was a comment here about a week ago from someone who successfully petitioned the German police to delete all footage of him at some protest
https://ico.org.uk/your-data-matters/cctv/ at least in the UK, you can request people who have CCTV footage of you, and also note that people have to delete CCTV when they no longer need it (how long that should be is arguable), so people have to delete CCTV without being prompted to. and this is not new with the GDPR, it's from the old law, from 1998, I think.