For me the issue is that it was apparently done in secret. The difference between CCTV that's stored for a day or two and then permanently deleted and cameras tracking behavior and recording data forever is different enough to require a very different kind of disclosure / signage.
"We track customer movement, behavior and tie that to an individual customer record. We keep this information in perpetuity to serve you better."
Not only that, usually cctvs have a tv facing the entrance with the feed and a reminder that you are on camera. This on the other hand, is Orwellian in comparison.
"We track customer movement, behavior and tie that to an individual customer record. We keep this information in perpetuity to serve you better."
Gotta have that "serve you better" on there.