If you're talking about standard security cameras usually the footage will get completely overwritten after afeew days unless there was an incident to prompt review of the footage-- and even then it usually gets deleted at some point. Its not like with social media data gathering where they're collecting all that information in order to build a personal profile of everyone-- security cameras just exist to review incidents that happen in the public realm and there's no real incentive for a public transit agency to track every single person that appears on their cameras.