ICO reprimands Metropolitan Police over unapproved Auror use that exposed 179 people's personal data, including three children
The UK Information Commissioner's Office (ICO) has reprimanded the Metropolitan Police Service (MPS) and issued an enforcement notice. Between March 2023 and September 2024, officers registered about 500 free accounts on the retail crime platform Auror without formal procurement, a data protection impact assessment (DPIA) or data-sharing agreements with Auror Europe. Officers unlawfully uploaded personal data on 179 people, including three children. The ICO called the oversight failures ongoing and a repeat of the force's 2021 unapproved use of Clearview AI. The MPS accepts the findings and says Auror has since been approved and is used in 14 London boroughs.
Detalhes técnicos
- Names only were uploaded for 128 people. Names and dates of birth were uploaded for 49, and names, dates of birth and home addresses for two.
- Officers also collected CCTV footage from the platform without any checks.
- Two internal security reports were filed in August and September 2024. Access was blocked on 26 September 2024.
- The MPS data protection officer told the ICO in December 2024, and a formal probe began in April 2025.
- The ICO found the MPS relied on soft controls (policy reminders, training) rather than technical blocks to stop use of unapproved software.
- The force had not tested its web controls: Auror was used for over 18 months without triggering an alert.
- Retailers encouraged officers to use the platform to access CCTV footage.
Remediação
- The enforcement notice requires the MPS to strengthen safeguards against improper use of third-party tools and to give the ICO periodic progress updates.
- The MPS says it has completed legal, security, commercial and data protection checks and approved the platform after a pilot.
- The ICO's findings point to technical blocking of unapproved platforms and regular testing of web controls.
Linha do tempo
-
ICO reprimands Metropolitan Police over unapproved Auror use that exposed 179 people's personal data, including three children
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) has reprimanded the Metropolitan Police Service (MPS) and issued an enforcement notice. Between March 2023 and September 2024, officers registered about 500 free accounts on the retail crime platform Auror without formal procurement, a data protection impact assessment (DPIA) or data-sharing agreements with Auror Europe. Officers unlawfully uploaded personal data on 179 people, including three children. The ICO called the oversight failures ongoing and a repeat of the force's 2021 unapproved use of Clearview AI. The MPS accepts the findings and says Auror has since been approved and is used in 14 London boroughs.
Technical Details
- Names only were uploaded for 128 people. Names and dates of birth were uploaded for 49, and names, dates of birth and home addresses for two.
- Officers also collected CCTV footage from the platform without any checks.
- Two internal security reports were filed in August and September 2024. Access was blocked on 26 September 2024.
- The MPS data protection officer told the ICO in December 2024, and a formal probe began in April 2025.
- The ICO found the MPS relied on soft controls (policy reminders, training) rather than technical blocks to stop use of unapproved software.
- The force had not tested its web controls: Auror was used for over 18 months without triggering an alert.
- Retailers encouraged officers to use the platform to access CCTV footage.
Remediation
- The enforcement notice requires the MPS to strengthen safeguards against improper use of third-party tools and to give the ICO periodic progress updates.
- The MPS says it has completed legal, security, commercial and data protection checks and approved the platform after a pilot.
- The ICO's findings point to technical blocking of unapproved platforms and regular testing of web controls.