We can keep information about criminals in databases for up to 10 years. So five years seems entirely reasonable to me, and I would not want security to be compromised because the relevant information had not been kept long enough.
On April 24th, 2018. See this statement in context.