(03 Dec 2022, 3:34 pm)Unber43 wrote What about the police sharing footage?

The police are allowed to do so because they are classed as a 'competent authority' (although their competency may be questioned in light of Sarah Everard and other recent cases), and sharing of CCTV information is allowed where it is deemed to be necessary or proportionate (eg. duties of law enforcement or crime prevention). 

Bus companies are not 'competent authorities' (nor should they be), and therefore have to follow the same guidelines as everybody else with regard to CCTV and GDPR.