"Legitimate interest" is used to cover a wide range of bullshit. I've seen it in a shop that had facial recognition cameras, they had a little sign by the tills that said "We use facial recognition for crime prevention and legitimate interest purposes" without even a clear way of opting out.
This was a gas station, so they require motorcyclists to take helmets off. Post-covid you could probably argue for wearing a mask, though if you were wearing a balaclava I think they might ask you to lower it. The law doesn't much matter here as they're a private business and can dictate terms of service.