The Information Commissioner’s Office (ICO) has issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after finding that officers and staff shared personal information through an unapproved third-party platform without adequate data protection safeguards.

An investigation by the UK’s data protection regulator found that the force had used Auror, a retail crime intelligence-sharing platform, between March 2023 and September 2024, despite the technology not having received formal approval.

During this period, approximately 500 MPS accounts were created on the platform, of which 375 were actively used for policing activities.

Auror enables retailers and law enforcement agencies to share intelligence relating to retail crime, providing incident summaries, case management tools, data visualisation and reporting capabilities.

The platform also includes a feature called “Connect the Dots”, which uses image matching and manual suggestions to identify potential connections between incidents and individuals.

However, the ICO found that between January and September 2024, MPS officers uploaded personal information relating to 179 individuals suspected of shoplifting, including three people under the age of 18.

The information shared included names, dates of birth and, in a small number of cases, home addresses.

Two internal security incident reports were raised during this period. One concerned an officer uploading the full names of suspects identified in CCTV footage shared by a retailer, while the other involved officers using the platform to obtain CCTV images from retailers despite it not having been approved by the force’s cybersecurity team.

The ICO identified four infringements of data protection requirements, including the unlawful processing of personal information without individuals’ consent and in circumstances where sharing was not necessary for law enforcement purposes.

It also found that the force had failed to implement appropriate technical and organisational measures to protect personal information and ensure that established assessment and approval processes for third-party technologies were followed.

Additionally, the MPS had not completed a data protection impact assessment before undertaking high-risk processing activities.

The regulator concluded that the force continues to lack adequate measures to ensure that only approved third-party technologies are used to process personal information.

David Doodson, ICO Head of Investigations, said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.

“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.

“This action should send a message across the policing sector, and beyond: if you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.”

Governance Improvements Required

The ICO acknowledged that the MPS had suspended its use of Auror in September 2024 and subsequently introduced a number of improvements before reintroducing the platform in January 2026.

These measures included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment.

Recommended reading

• Report: Cyber Breaches Are Tanking Share Prices
• Human Error Costing UK Business Billions in Data Breach Losses
• Inside the Aftermath: What Really Happens When You Get Hacked
• Report: 93% of Data Breaches Expose Financial Records

Despite these changes, the regulator determined that further action was necessary to address broader concerns surrounding the force’s governance and oversight of third-party technologies.

Under the enforcement notice, the MPS must strengthen its procedures for identifying, assessing and approving external services used to process personal information.

The force is also required to review existing controls, improve governance processes, increase staff awareness of data protection requirements and regularly test the effectiveness of its safeguards.

The ICO has instructed the MPS to provide periodic updates demonstrating its progress in implementing the required measures.

The regulatory action highlights concerns over the adoption of third-party technologies within policing, particularly where operational benefits have been pursued without sufficient consideration of data protection obligations.

Doodson added: “Where organisations fail to protect people’s information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”