If nothing else, this is a good example of why the contract terms for government vendors MUST be public records and NDAs of private companies on public officials for the purposes of sales should not be legally enforceable.
The first thing the city should do when cancelling is lock down the data so no jurisdictions have access to the data. Even if the cameras are still powered on and connected, any ongoing searches should not return any results from that jurisdiction.