I'm afraid you have got this round your neck. Your interpretation may have been correct 10 years ago but it is far off the mark now. Surveillance cameras which go beyond domestic boundaries are captured under GDPR. If they don't then it will be domestic processing, and not subject to GDPR. RIPA for this scenario is irrelevant.I think your son is misinterpreting the regulations.
I was a data regulator, and a RIPA authorising officer and worked very closely with the very first Information officer - or IOCCO as it was known then.
The regulations apply to public bodies and organisations that gather and process this data - so people like the police, Security services, MOD, Prisons and local authorities, private individuals are exempt.
There has been talk for many years about semi bringing private individuals under some aspects of data collection from Cameras regarding home CCTV and there is advice published to those who may use data collected for bearing no regard for collateral collection - but it is just advice and the law has never been specifically examined in order to make home CCTV or in this case Dash Cams in cars under the IOCCO rules. This includes CCTV operating in shops - only proviso there is there should be signage to tell people their Overt cameras are recording people within the shop - so their choice to go in or not - and if they enter they are deemed to have granted permission to film them.
Its all a bit of a grey area because by bringing dash cams, Home CCTV under those regulations it would open up issues regarding ANPR, I indicate ANPR because its a lot different to home CCTV and Dash cams in that Home and Car cams are not "targeting" individuals - and its the word "targeting" that becomes most relevant in CCTV data collection. Overt CCTV - the equipment can be seen and maybe some signage is completely different to Covert data collection - where cameras are hidden or targeted at an individual without their knowledge with the intention of processing that data.
ANPR is in a unique field in that it "Targets" every vehicle in any lane - its specifically reading number plates and then actively looking for the plate again to monitor its speed/direction etc. Targeted data collection requires an Authorisation process from a RIPA qualified authoriser - but so far the law makes cant agree on this aspect.
scanning an area isn't regarded as Surveillance of an individual and requires no authorisation.
This topic has been discussed by many people over very many years - indeed I have been retired 10 years now and I dealt with IOCCO for over 8 years - the guidance and rules were always under review and I have tried to keep up to date with regulation changes - and to my knowledge Home CCTV and Dash Cams remain exempt from the regulations.
Most MOD sites restrict CCTV recordings, all prisons restrict cameras too but In all my days as head of Security within a prison I had to give specific instructions to gate staff to look for and ask drivers that were entering If they had dash cams as many are not obvious, in fact vehicles entering most sites are restricted to suppliers who have agreed not to have or to disable any Dash Cams on entering a site - breaching this rule would have consequences for that supplier in that they would loose their contract.
Surveillance systems are legitimised, in the main, because they are necessary for the prevention and detection of crime.
ANPR is lawful under Part 3 (Law enforcement processing) of the Data Protection Act 2018 (note not GDPR, as GDPR does not cover law enforcement processing.)
Anyway, my own view is don't worry about it - the regulator has much bigger fish to fry. Like some one said previously, just avoid splashing it over social media and use it with care.