Unapproved Platform, Real Consequences: UK Regulator Reprimands London Police Over Third-Party Data Use

The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) after governance failings linked to its use of Auror, a retail crime intelligence-sharing platform used in a crackdown on shoplifting. The ICO found that between March 2023 and September 2024, officers and staff used the platform even though it had not been formally approved. About 500 accounts were created, and 375 were active.

Between January and September 2024, personal information on 179 people was uploaded to the unvetted platform. This included names, dates of birth and home addresses, and three of the people were under 18. Two internal security incident reports were raised. In one, an officer uploaded the full names of suspects recognised in retailer CCTV images. In the other, officers were flagged for collecting CCTV images from retailers through a platform the MPS cybersecurity team had not approved. The ICO found four infringements.

David Doodson, the ICO's head of investigations, said organisations cannot let innovation outpace their data protection responsibilities. He said they must assess risks, put safeguards in place and ensure effective oversight before introducing new systems or platforms. The ICO said the action should send a message to the policing sector and beyond.