Data Protection refers to any information you as an organisation hold about an individual, ie records, accounts etc either written or computer based and it cannot be released to a 3rd party without the consent of that person, unless there are data sharing protocols in place such as financial companies use to put you on a bad debtors list or give you credit. CCTV doesn't come under the Data Protection Act, plus you are right, there are information sharing protocols between agencies now. Ask your boss just what she thinks CCTV is for then?