If you walk into a shop and the cameras record what you do, then there has to be a mechanism in place to ensure that the data is only able to be used for the pu

If you walk into a shop and the cameras record what you do, then there has to be a mechanism in place to ensure that the data is only able to be used for the purpose it was collected for (that is, crime prevention and law enforcement), and that it is destroyed after a defined time-frame. That satisfies the GDPR, as you're collecting the data for a legitimate purpose (for which you don't need to seek consent) and preventing its use for any other purpose (which would need separate informed consent). The destruction time-limit also helps prevent its use for other purposes by reducing the opportunity for unauthorised access. You'd probably (IANAL) still have to have a "Smile, you're on camera" notice up though.