Sharing CCTV images on social media (Wales)

hello,

I'm asking this on behalf one of the people involved. He was basically caught stealing from one of the local stores and they capture him on CCTV doing so. The store owners have plastered his face all over their Facebook page, they have also done this to others they have caught on CCTV as well.

My question is what is the legality of this and does it fall foul of GDPR? He knows what he did was wrong but believes his face should not be posted for others to see and would like them taken down. Does he have any legal leg to stand on? I know it sounds ironic talking about legality after what he did but I would also be interested to know this as well.

I want to make it clear I do not condone what he did and he is not a close friend of mine I only speak to him when I see him in passing.

Thanks.