LOPD law controls databases of personal information in any form: photo, video, text information...
https://www.agpd.es/portalwebAGPD/english_resources/regulations/common/pdfs/Ley_Orgaica_15-99_ingles.pdf [EN]
It's a hard law and it's one of the best in the world regarding protection of individuals information.
Just in 2009 where imposed 29million euros in fines.
About CCTV sytems:
If you have a CCTV system and you are not "the police", it cannot be pointing to the streets, it only can record images of your own premises.
Also, every database of personal information has to be registered on the Data Protection Agency
If you are recording people by any means on your premises, you have to put up signs on the entrances showing up who's responsible of that images and where to contact.
If you are going to a soccer game you'll also find any information related to your image in the back of your tickets, same as you go to a music show or something similar.
If you are "the police" and have any kind of CCTV recording devices on the street, you also have to put information and who's on charge of that.
And you have the legal rights to access, modify, correct or delete any of your information in that databases.
Not only that, but, if you see any kind of CCTV recording system that's not complying, you don't need to bring the lawyers, you only have to alert the Data Protection Agency via email or phone, and they are legally mandated to investigate and press charges by themselves.
About 'secret investigations', police is only able to mantain that personal information while they are conducting that investigation, and the information taken is relevant for it. If the infomation is not relevant or not needed anymore, it has to be deleted.
CCTV recording operations is indiscriminate, is not watching suspected terrorist or delincuents. It doesn't follow any investigation or need, it's just a mass control system.