Nothing in this report indicates that policy was being broken.
There was a misconfiguration of the tool. They didn’t realize that the internal sharing link was publicly accessible.
But since you brought it up, SFPD should also have a policy on when they share drone footage, and I'm going to assume they violated that. In this case I think it's reasonable to take them at their word that it was accidental and they are learning from it. And I'd be a lot more concerned anyway if it were ubiquitous surveillance of ordinary citizens, not just incidental captures during scoped, presumed legitimate operations.