Metropolitan Police reprimanded by ICO over unauthorized data sharing

The Information Commissioner’s Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service following the unauthorized use of a third-party retail crime intelligence platform. Between March 2023 and September 2024, officers and staff used the Auror platform—a tool used by retailers to track shoplifting—without formal police approval or adequate data protection safeguards.

An investigation revealed that approximately 500 accounts were created on the platform, with 375 used for policing activities. Between January and September 2024, personal data belonging to 179 individuals, including three minors, was uploaded to the service. This sensitive information included names, dates of birth, and, in some instances, home addresses.

The ICO determined that the Metropolitan Police failed to implement necessary technical restrictions to prevent the use of ‘shadow IT’ and did not complete required data protection impact assessments for high-risk processing. The watchdog noted that the service has demonstrated an “ongoing failure” to prevent staff from using unauthorized services, citing a previous failure to block the use of the facial recognition application Clearview four years prior.