I’m curious as to what would the legalities be if I were to post a review of a local restaurant (negative) and include a photo I took at the time of the poor service that included the extremely rude employee working behind the counter... is that legal? The establishment does not care about my concerns so I wanted to post a detailed review but don’t want to be sued.
First of all, as several comments have said, anyone can sue for just about anything. Some suits are obviously without merit and will be promptly dismissed, and the people filing such suits may be penalized by the court, but the suits were still filed.
If the online review contains statements of fact, or purported fact, which are defamatory, or which might be claimed to be defamatory, a suit for defamation might well be filed. To win such a suit, the plaintiff (presumably the employee or perhaps the store owner) would need to prove that the statements were false (or at least that some of them were) and that they did actual harm to the plaintiff's reputation. If the plaintiff is a "public figure" there would also need to be proof of "actual malice", that is knowing falsehood or reckless disregard of possible falsehood. However an individual retail employee is probably not a public figure.
If an online review contains only statements of opinion, any defamation suit would be obviously without merit, and would probably be dismissed early. Few reputable lawyers would file such a suit.
Filing a defamation suit involves significant upfront expense, time, and trouble. Most retail employees will not be able to afford the costs of such a suit, even when there is a good chance of winning. A law firm might provide the expenses on a contingent fee basis, but only if they review the case and think there is a substantial chance of winning, because they lose money in such a case if they do not prevail or at least get a significant settlement.
I see this was tagged "copyright". No one has a copyright on their personal appearance, or on actual real events. An account of things that really happened, if it is not copied from someone else's account, is not an infringement of anyone's copyright. There simply is not copyright issue in the situation as described in the question, and I will be changing the tags.
Invasion of Privacy
In some US states there are torts of invasion of privacy of several kinds for which a person could sue. None of these seem to apply to the situation as described in the question.
Right of Publicity
In some US states a person has a right of publicity, so that the person's image or likeness may not be used to advertise or promote things without permission. (This is also known as the Tort of Appropriation.) But here the poster of the review would not be using the employee's picture to promote anything, rather the opposite. There seems to be no valid basis for a suit on such grounds in the situation described in the question.
In some US states a person may sue when private facts are disclosed in a way that is highly embarrassing. But to win such a suit, significant efforts to keep the facts private must have been taken, and the disclosure must be clearly offensive to a reasonable person.
Intrusion Upon Seclusion
This applies where a person's home or other private space is violated, either directly or though technology. This can include a classic eavesdropper or "Peeping Tom", or a bug. It can also include concealed still or video cameras. But in all such cases, the person intruded upon must have a "reasonable expectation of privacy". No one working behind the counter of a retail store, serving the public, or as a waiter in a restaurant, has such an expectation while at work.
Some US states recognize a tort of "false light". This is similar to a defamation case, however, it is used when no actual false statements are made, but the statements are misleading while technically true. This generally requires proof of "actual malice", even if the plaintiff is not a public figure. According to the *Restatement of Torts 92nd) section 652E:
One who gives publicity to a matter concerning another before the public in a false light is subject to liability to the other for invasion of privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in a reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.
Such suit does not seem likely to prevail in the situation described, and many of the issues discussed above under "Defamation" would also apply. The requirement to prove actual malice further hinders any such suit.
There seems no basis for the waiter, or the store owner, to prevail in any suit based upon posting the waiter's photo along with a negative review online. Filing such a suit is always possible, but seems unlikely, precisely because it has little chancy of success.