ICO reprimands Metropolitan Police over unapproved use of Auror platform that exposed personal data of 179 people
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:06; os links antigos trazem para cá.
The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) over governance failures in its use of the third-party retail crime intelligence-sharing platform Auror (infosecurity-magazine.com, digit.fyi). Between March 2023 and September 2024, officers and staff used Auror without formal approval, creating about 500 accounts, of which 375 were actively used. Between January and September 2024, personal data on 179 individuals, three of them under 18, was uploaded to the unvetted platform. Digit.fyi describes them as people suspected of shoplifting. The ICO found four infringements and concluded that the force still lacks adequate measures to ensure only approved third-party technologies process personal information. It also warned the wider policing sector that innovation must not outpace data protection obligations (infosecurity-magazine.com). No external attacker, malware or exploitation is described; this is an internal governance and shadow-IT failure.
Detalhes técnicos
- Auror offers incident summaries, case management, data visualisation, reporting and a "Connect the Dots" module that uses image matching and manual suggestions to link events and individuals.
- The uploaded data included names, dates of birth and home addresses.
- Two internal security incident reports were raised. In the first, an officer uploaded the full names of suspects recognised in retailer-supplied CCTV images. In the second, officers were flagged for using the platform to collect retailer CCTV images although the MPS cybersecurity team had not approved Auror.
- The four ICO findings were:
- unlawful processing without consent where sharing was not necessary for law enforcement purposes;
- failure to implement appropriate technical and organisational measures, and to follow assessment and approval processes for third-party technologies;
- failure to complete a data protection impact assessment (DPIA) before high-risk processing;
- a continuing failure to ensure only approved third-party technologies process personal information.
- The MPS suspended Auror in September 2024. It reintroduced the platform in January 2026 after improving governance, training and contractual controls and completing a DPIA (digit.fyi).
Remediação
- The enforcement notice requires the MPS to address the continuing failure to restrict processing to approved third-party technologies (infosecurity-magazine.com).
- The MPS must strengthen procedures for identifying, assessing and approving external services that process personal information, review existing controls, improve governance, raise staff awareness and regularly test the effectiveness of its safeguards. It must also give the ICO periodic progress updates (digit.fyi).
- Other organisations should assess risks, complete a DPIA and obtain security approval before adopting new platforms that process personal data, and keep effective oversight of their use (infosecurity-magazine.com).
Relatos divergentes
- Home addresses: infosecurity-magazine.com lists home addresses among the uploaded data without qualification. digit.fyi says they were included only in a small number of cases. The qualified digit.fyi wording is the more specific, and the more recent of the two.
- Current compliance status: infosecurity-magazine.com stresses the continuing failure to restrict processing to approved technologies. digit.fyi, the more recent source, adds that Auror was reintroduced in January 2026 after a DPIA and governance improvements, while the ICO still concluded that adequate measures were lacking.
Linha do tempo
-
ICO reprimands Metropolitan Police over unapproved use of Auror platform that exposed personal data of 179 people
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) over governance failures in its use of the third-party Auror retail crime intelligence-sharing platform. Between March 2023 and September 2024, MPS officers and staff used Auror without formal approval, creating around 500 accounts, of which 375 were active. Between January and September 2024, personal data on 179 individuals, three of them under 18, was uploaded to the unvetted platform. The ICO found four infringements and warned the wider policing sector that innovation must not outpace data protection obligations.
Technical Details
- Uploaded data included names, dates of birth and home addresses.
- Two internal security incident reports were raised. In the first, an officer uploaded the full names of suspects recognized in retailer-supplied CCTV images. In the second, officers were flagged for using the platform to collect CCTV images from retailers although the MPS cybersecurity team had not approved Auror.
- Auror offers incident summaries, case management, data visualisation, reporting and a "Connect the Dots" module that uses image matching and manual suggestions to link events and individuals.
- ICO findings: (1) unlawful processing without consent where sharing was not necessary for law enforcement purposes; (2) failure to implement appropriate technical and organizational measures and to follow assessment and approval processes for third-party technologies; (3) failure to complete a data protection impact assessment (DPIA) before high-risk processing; (4) continuing failure to ensure only approved third-party technologies process personal information.
- The article describes no external attacker, malware or exploitation. This is an internal governance and shadow-IT failure.
Remediation
- The ICO issued an enforcement notice requiring the MPS to address the continuing failure to restrict processing to approved third-party technologies.
- Organizations should assess risks, complete a DPIA and obtain security approval before adopting new platforms that process personal data, and maintain effective oversight of their use.
-
ICO reprimands Met Police over use of unapproved Auror retail crime data-sharing platform
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after officers and staff shared personal information through the unapproved third-party platform Auror without adequate data protection safeguards. The platform was used between March 2023 and September 2024, with about 500 MPS accounts created and 375 actively used. Between January and September 2024, officers uploaded personal data on 179 individuals suspected of shoplifting, including three minors. The ICO found four infringements and concluded that the force still lacks adequate measures to ensure only approved third-party technologies process personal information.
Technical Details
- Auror is a retail crime intelligence-sharing platform with incident summaries, case management, data visualisation and a "Connect the Dots" feature that uses image matching and manual suggestions to link incidents and individuals.
- Data uploaded included names, dates of birth and, in a small number of cases, home addresses.
- Two internal security incident reports were raised: one for an officer uploading full names of suspects identified in retailer CCTV footage, the other for officers using the platform to obtain retailer CCTV images without approval from the force's cybersecurity team.
- The four infringements covered unlawful processing without consent where sharing was not necessary for law enforcement purposes, failure to implement appropriate technical and organisational measures, failure to follow third-party technology assessment and approval processes, and no data protection impact assessment before high-risk processing.
- The MPS suspended Auror in September 2024 and reintroduced it in January 2026 after improving governance, training, contractual controls and completing a DPIA.
Remediation
- Under the enforcement notice, the MPS must strengthen procedures for identifying, assessing and approving external services that process personal information.
- The force must review existing controls, improve governance, raise staff awareness of data protection requirements and regularly test the effectiveness of its safeguards.
- The MPS must provide the ICO with periodic progress updates.