With a few very limited exceptions (which aren't relevant here) anyone has the right to photograph anything, or anyone, as long as they (or their camera) are:
(a) in a public place ;
(b) on their own property ; or
(c) in a place where they've been given permission to take photographs.
So, for example, it's perfectly lawful for someone to stand in the street and photograph you in your front garden or (through your windows) inside your house.
So it should be obvious that an employee of a company, acting on behalf of that company, has the right to take a photograph of you on the company's premises.
Even if someone takes a photograph of you when none of (a), (b) and (c), above, apply, they're still not committing a criminal offence. It's only a civil matter. (e.g. there's no law that prohibits someone from entering your front garden and taking photographs of you there or through your windows).
So the clear answer to your first question is: Yes.
The answer to q2 depends upon the company's policy. As they hold the copyright to the photograph, they're basically free to do with it as they wish. They can't, however, display it in a public place with a label saying 'Shoplifter', as that amounts to harassment. However they can, and probably will, make it available to all of their staff so that you can either be monitored or refused entry in future. (That seems to answer q3 as well).