Where the line is always drawn for me, at a minimum, is what they do with the video and who has access to it.
Video should always be deleted when it is no longer reasonably needed. That timeline would be different for airports vs convenience stores, but I'd always expect the scale of days or weeks rather than months or years (or indefinitely).
Maybe more importantly, surveillance video should never be shared without a lawful warrant, including clear descriptions of the limits to what is needed and why it is requested.