> Should they not be allowed to do that?

If that camera system is closed-circuit and its data is restricted to the premises they should be permitted to do that.

If the data from that camera system [0] can be removed from the premises by anything less than a search warrant or court order, then no, they should not be permitted to do that.

I know this isn't how the relevant laws work now, but they haven't been adequately updated to account for radical changes in the ability for companies to perform mass surveillance.

[0] ...whether raw or "processed" by -say- a "customer analytics" software... [1]

[1] Want a count of the day's customers? Check register receipts. Want to know what displays are most popular? Ask your employees, or employ someone to take notes. etc, etc, etc.