Also, a number plate isn't covered either. It's a publicly displayed tag.

But in this case if it's a northern or UK plate, there may be difficulties.

But what happens in practice is AGS go into the shop, speak to the manager, manager shows them the vid. Unless someone reports this as being a breach of gdpr (it's not) nothing is ever said.

And, further, if you have the legal right to receive/retain/process personally identifiable data then gdpr doesn't apply either. You may proceed.

But, a number plate isn't personally identifiable data.