Comment Seems reasonable (Score 3, Informative) 18
Companies should, in general, avoid keeping any user data one second longer than they legitimately need it. Data should be viewed as a liability more than an asset, and every company that achieves significant scale with user data soon realizes this, though some take longer than others to learn the lesson.
The reason it's a liability is because it exposes the company to an endless stream of warrants and subpoenas, and contrary to popular belief, the government does not pay for that data. In some cases the government might pay a portion of the expenses the company incurs in responding, but it's always still a net loss, and most of the time the government just shows up with a court order and says "Hand it over or be held in contempt of court". What makes it even worse is if companies actually want to be good stewards of the data and not hand over more than they should, they'll often get overly-broad requests and then have to go to court to fight to narrow or quash the requests.
This all gets very expensive. It's just a cost of doing business... but it's a cost that can be avoided if you don't have and can't get the data.
Encrypt everything, and arrange to destroy the keys when you no longer need the data is the best way to do it, too. Scrubbing large databases quickly and effectively is hard. Deleting a set of AES keys is a lot easier. This also means that you can focus your internal access controls on controlling which systems and employees can get the keys.
I'd encourage Ring to find ways to close the window of access even more.