There is no clear law in the UK which protects image rights. The most relevant area of law is the Data Protection Act 1998 (DPA).
A photograph of a person is likely to constitute personal data under the DPA if that person can be identified from it. The Information Commissioner has issued guidance as to what information is likely to constitute personal data under the DPA, including images and the use of CCTV.
The law relating to what constitutes personal data as far as photographs and images are concerned is complex.