A parks permit AI stores biometric face photos from kiosk check-in beyond the stated operational need. What should the auditor emphasize?

A parks permit AI that stores biometric face photos from kiosk check-in beyond the stated operational need creates special-category privacy risk that ordinary event photography controls do not address. The auditor should emphasize limiting collection and retention of biometric photos to documented necessity and authorized retention periods because biometric identifiers are highly sensitive, hard to revoke once compromised, and frequently regulated under municipal, state, or sector privacy rules. Necessity and retention limits tie the parks program to minimization: keep faces only while the check-in purpose remains valid, then dispose or de-identify under policy. Retaining biometric photos for secondary analysis once the check-in system is decommissioned and approved for archival fails by concept: decommissioning and archival approval do not retroactively create the original necessity, and secondary analysis is a new purpose that still needs its own documented basis and retention limit. Applying standard IT access logging to biometric stores, using the same log retention as other business records, fails by concept: biometric identifiers carry materially higher sensitivity than ordinary business records and warrant heightened classification, access, and retention controls beyond generic IT logging. Extending retention of high-resolution biometric photos to support future model tuning and service evaluation fails by concept: model-improvement and evaluation work is a new purpose beyond the original check-in need, so keeping identifiable biometric imagery for it still requires its own documented necessity and authorized retention period rather than an open-ended extension of the check-in retention clock. Exam caveat: AAIA items on civic biometrics reward documented necessity, minimization, and enforceable retention tied to authorized uses—not indefinite reuse for retraining or evaluation, or "photos are just photos" reasoning. Operational check: inventory parks-kiosk biometric stores, verify purpose statements and retention schedules, confirm automated deletion or archival gates fire when the operational need ends, and sample access logs for unauthorized secondary use.