Metropolitan Police Faces ICO Scrutiny Over Unsanctioned Use of Shoplifting Data Platform
London's Metropolitan Police Service (MPS) has been issued an enforcement notice by the UK's Information Commissioner's Office (ICO) for unlawfully using the Auror retail crime platform without proper data protection checks or formal procurement.
London's Metropolitan Police Service (MPS) is facing significant repercussions from the Information Commissioner's Office (ICO) after officers were found to have used a third-party retail crime platform, Auror, without the force's official approval or necessary data protection assessments. Between March 2023 and September 2024, approximately 500 free accounts were registered on Auror by MPS officers. This platform is typically used by retailers to document incidents like shoplifting, and retailers encouraged officers to utilize it, often directing them to access CCTV footage through the service.
The core of the ICO's enforcement action lies in the MPS's failure to conduct proper due diligence. The force had not formally procured the Auror service, nor had it completed essential data protection impact assessments (DPIAs) or established formal data-sharing agreements with Auror Europe, the platform's UK subsidiary. This oversight allowed officers to upload personal data of 179 individuals, including three children, to the platform. The data compromised ranged from names alone to names, dates of birth, and even home addresses for some individuals.
Internal security reports filed in August and September 2024 highlighted concerns about officers uploading suspect names from CCTV footage and collecting footage from the platform without adequate checks. Despite these internal flags, access to Auror was only blocked on September 26, 2024. The ICO was alerted in December 2024 and launched a formal investigation in April 2025, uncovering the extent of the unlawful data processing.
The ICO's investigation revealed a systemic failure in oversight within the MPS, particularly concerning the use of third-party platforms by officers. The regulator criticized the force for being overly reliant on 'soft controls' such as policy reminders and training, which are often overlooked, instead of implementing robust technical blocks to prevent the use of unapproved software. The ICO noted that officers had been using Auror for over 18 months without triggering any alerts, indicating a significant gap in the force's web controls and monitoring capabilities.
This incident is not an isolated one for the MPS. The ICO explicitly drew parallels to the force's previous misuse of Clearview AI in 2021, which also occurred without proper oversight. The regulator considers the current failures ongoing because the MPS has not yet demonstrated that its revised safeguards are sufficient to prevent similar breaches in the future. The enforcement notice mandates that the MPS must strengthen its controls for third-party tools and provide regular progress updates to the ICO.
David Doodson, head of investigations at the ICO, emphasized the broader implications of this case, stating, "This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset." He reiterated the ICO's commitment to holding organizations accountable and driving improvements in data protection standards.
In response, an MPS spokesperson acknowledged the ICO's findings regarding insufficient data protection arrangements at the time. They stated that officers were acting in good faith to identify shoplifters but recognized the necessary legal and security work had not been completed. Following the immediate suspension of access and a full review, the platform has since received formal approval and is now being used in 14 London boroughs as part of a pilot scheme. The MPS claims this has significantly improved shoplifting investigations, quadrupling positive outcomes.
This reprimand follows another recent rebuke from the ICO in August concerning separate data mishandling incidents. In one case, a Met officer inadvertently exposed a victim's new home address and contact details by sending unredacted legal documents. In another, an officer mistakenly revealed the email addresses of 18 individuals linked to Parliament by failing to use BCC when sending an email. These incidents collectively highlight ongoing challenges within the MPS regarding data security and adherence to privacy regulations.
The Information Commissioner's Office (ICO) has issued a formal reprimand and enforcement notice to the Metropolitan Police Service (MPS) following an investigation into their use of the Auror retail crime intelligence-sharing platform. The ICO found that between March 2023 and September 2024, MPS officers utilized the platform without formal approval, leading to the unlawful processing of personal data for 179 individuals, including three minors. Specific failings included uploading sensitive information without consent, failing to implement adequate technical and organizational measures, and neglecting to conduct a data protection impact assessment for high-risk processing.