I'm questioning what the law should be, not whether VTEC were correct or wrong in this case considering existing law.
The law should be clear, CCTV images are taken and can be used for listed purposes according to the CCTV code, however should only be stored for purposes of crime prevention, should be stored for a set period of 28 days, no more, no less, should be accessible to those in the image, however all identification of anyone else in the image should be masked, should be accessible to law enforcement in that period, should be accessible by court order, and should not be transferred to another company.