This is illegal. They are using legitimate interest as the legal basis which is not legal to use when using biometric technology as it's collecting sensitive data to which explicit consent must be obtained, and in order for this to be legal it must be freely-given (there must be choice) and informed.
Co-op is using facial recognition tech to scan and track shoppers
Branches of the Southern Co-op are using facial recognition to look for potential shoplifters. The roll-out raises concerns about the creep of surveillance tech in the private sector