When any personal data you have collected has been used for the specific purpose it serves it should be deleted or destroyed as soon as it is viable to do so. Properly deleted data cannot be misused or be at risk of being erroneously released.
There is no benefit to holding data that cannot legitimately be used, so the smarter policy is to not hold on to it for any longer than is required.