Well according to Flock, the data is actually owned by the city and they are already responsible. This is just private sector loopholing

And in reality, it's a handwave. The city will refer you to Flock, and then Flock will cancel the contract, but leave the cameras up, so now there's no customer. Funny that.