London Police Reprimanded After Officers Used Unapproved Retail Crime Platform

The UK's Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) and issued an enforcement notice. Between March 2023 and September 2024, officers registered around 500 free accounts on Auror, a platform retailers use to record crimes such as shoplifting and share reports, images and CCTV footage. The force had not formally bought the service, completed a data protection impact assessment, or set up data-sharing agreements with Auror Europe. Retailers such as supermarkets had encouraged officers to use the platform to access CCTV footage.

The ICO found that officers unlawfully uploaded personal data relating to 179 people, including three children. For 128 people this was names only; for 49 it was names and dates of birth; and for two it included home addresses. Two internal security reports were filed in August and September 2024, and access to Auror was blocked on 26 September 2024. The force's data protection officer told the ICO about the use in December 2024, and a formal probe began in April 2025.

The ICO said the MPS failed to ensure adequate oversight when deciding which third-party platforms officers could use, and that these failures persist today. It also said the force relies too heavily on soft controls, such as policy reminders and staff training, which often go unnoticed, rather than technical blocks on unapproved software.