An Illinois college’s attempt to remove security cameras from its campus after raising concerns about data sharing, access controls and possible misuse has drawn attention to a broader business issue: organisations may find it harder than expected to exit surveillance technology contracts once systems are installed.

While the case is in the US, the issues it raises are relevant for European businesses, schools, property operators and other organisations using connected cameras, licence plate recognition or cloud-managed security platforms. The practical lesson is less about one provider and more about how contracts, data access and compliance responsibilities should be handled before deployment.

What happened

According to the source report, Elgin Community College in Illinois installed six Flock Safety cameras in April 2025 as part of its campus security measures. By September 2025, the college had reportedly become concerned about several issues, including alleged data sharing with US Customs and Border Patrol, security of camera feeds, and possible misuse of access by law enforcement and company employees.

The college then asked Flock Safety in October 2025 to remove the cameras. According to reporting cited in the source, the company rejected that request, arguing it had not breached its contract. The dispute therefore appears to centre not only on security and privacy concerns, but also on whether the customer had a contractual route to terminate the arrangement early.

The article does not establish any final legal finding on the allegations. However, the reported disagreement is a reminder that connected security systems can create long-term operational, legal and reputational consequences if data access and exit terms are unclear.

Why it matters for European businesses

For European organisations, the most important issue is not the US campus itself, but the risk profile of modern surveillance platforms. Many camera and sensor systems now depend on cloud services, remote administration, shared access models and broad data integrations. That can create several business risks.

• Contract risk: A customer may assume it can remove or discontinue a service quickly, but the contract may limit termination rights or make early exit costly.
• Data governance risk: Organisations need to understand who can access footage or metadata, for what purposes, and under what legal basis.
• Privacy and compliance risk: In Europe, video surveillance and number-plate data can trigger GDPR obligations, and in some cases additional national rules or employment-law considerations.
• Security risk: If feeds, dashboards or user accounts are not tightly controlled, surveillance systems can become a source of internal misuse, unauthorised access or wider cyber exposure.
• Reputational risk: Concerns about how data is used or shared can quickly affect trust among staff, visitors, students, tenants or customers.

These issues are especially relevant as more organisations adopt smart-building technology, remote site monitoring and AI-assisted security tools. Even where a deployment appears operationally useful, the organisation using it still carries responsibility for vendor due diligence, lawful processing and appropriate technical and organisational safeguards.

Who may be affected

The lessons are relevant beyond education. European organisations that may want to review their position include:

• SMEs and founders using cloud-managed CCTV, access control or smart-premises systems.
• IT and security teams responsible for vendor assessments, identity management, logging and integration security.
• Regulated or privacy-sensitive organisations handling visitor monitoring, staff surveillance or vehicle tracking data.
• Retail, logistics and property businesses deploying licence plate recognition, perimeter monitoring or multi-site security systems.
• Digital agencies and technology advisers supporting clients on infrastructure procurement, compliance or connected-device governance.

Any organisation considering AI-enabled video analytics should be particularly careful, because the compliance and governance questions become more complex when behavioural analysis, automated alerts or cross-system data sharing are involved.

What companies should consider

• Review contract exit clauses before signing: Check termination rights, equipment removal obligations, notice periods, minimum terms and any fees tied to early cancellation.
• Clarify data ownership and access: Document who controls footage, metadata and audit logs, and whether the vendor, subcontractors or third parties can access them.
• Assess data-sharing arrangements: Ask whether data can be shared with public authorities or other third parties, in what circumstances, and under what documented process.
• Strengthen access controls: Apply least-privilege access, multi-factor authentication where available, and regular access reviews for internal and external users.
• Request security documentation: Obtain clear information on feed protection, logging, incident response, retention settings and administrative safeguards.
• Check GDPR roles and documentation: Determine whether the provider acts as a processor or controller for relevant processing activities, and ensure agreements reflect that distinction appropriately.
• Carry out a privacy assessment where needed: For higher-risk monitoring, a Data Protection Impact Assessment may be appropriate depending on the specific deployment and jurisdiction.
• Plan for offboarding in advance: Before deployment, define how cameras, stored data, credentials and integrations will be removed or transferred if the service ends.

For European businesses, the main takeaway is straightforward: security technology procurement should be treated as both a cybersecurity and privacy decision, not only a facilities purchase. The combination of surveillance data, cloud administration and restrictive contract terms can create operational exposure long after installation.