Retention and Deletion

Every deployment has a retention policy. Comparatively few have automated deletion that has been verified to work.

What is actually held

Worth enumerating, because deployments usually hold more than the policy describes.

Raw video, on the recorder.

Clips exported around detections.

Detection records: time, camera, class, confidence, bounding box.

Aggregates: counts, occupancy, dwell.

Templates, where identification is involved.

Training data, which is frequently forgotten and outlives everything else.

Backups of all of the above.

Logs of access, which are themselves personal data about staff.

Each needs its own period, and one blanket number for all of them is a policy that has not been thought about.

Setting the periods

From the purpose, not from what the storage allows.

Raw video: the shortest period that supports the investigation use. For most sites this is weeks rather than months.

Detection records: longer is defensible because they are small and less intrusive, and it should still be bounded.

Aggregates: long retention is usually fine, since they describe no individual.

Templates: as short as the enrolment purpose requires, with deletion on departure or withdrawal.

Training data: a stated period with a review, and a record of provenance.

Excess retention is itself a failure in several regimes, not a safe default.

Making deletion real

Automated, because manual deletion does not happen.

Verified, with a report of what was removed.

Including backups, which is where retained data survives a deletion policy and is the most common gap.

Including exports. A clip sent to a manager by email is now outside every control you have; policy should cover it and the practical answer is to make export produce a controlled link rather than a file.

Tested: attempt to retrieve something past its period and confirm it is gone rather than merely hidden from a report.

Legal hold

A mechanism to override deletion for a specific matter.

Applied before the automation runs, which requires whoever handles disputes to be part of the process.

Scoped: specific cameras, specific period, specific matter.

Released when the matter ends, because indefinite holds accumulate and quietly defeat the whole schedule.

Tested, by applying a hold and confirming the retention job respects it.

The export problem

The most common route by which retention is defeated.

Someone exports a clip for a meeting. It lives on a laptop, in an email, in a shared drive, indefinitely.

Log every export: who, what, when, why.

Prefer time-limited links to file downloads.

Review the export log, which is also the control that detects misuse.

Reporting it

Current holdings by category and age.

Deletion executed, as a periodic report rather than an assumption.

Holds active, with their age. A hold older than the matter is a finding.

Exports outstanding.

These four are cheap to produce and they are what an auditor asks for, and more importantly they are what tells you whether the policy is real.

Retention by category, tabulated

One blanket number is a policy that has not been thought about.

Raw video: weeks, tied to the investigation use.

Detection records: longer, bounded, because they are small and less intrusive.

Aggregates: long retention is usually fine; they describe no individual.

Templates: the enrolment period, with deletion on departure.

Training data: stated period with a review.

Exports: shortest of all, and logged.

Backups: the same periods, which is the gap that defeats most schedules.

The export leak

The most common route by which retention is defeated.

A clip exported for a meeting lives on a laptop, in an email, in a shared drive, indefinitely.

It is outside every control the system has.

Log every export: who, what, when, why.

Prefer time-limited links to file downloads, which keeps the copy under control.

Review the export log, which is also the control that detects misuse.

Include exports in the retention policy explicitly, because the default assumption is that they do not exist.