/
← Voltar ao feed
medium government law_enforcement retail

ICO reprimands Metropolitan Police over unapproved use of Auror platform that exposed personal data of 179 people

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 05:30 · coletado há 3 dias

The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) over governance failures in its use of the third-party Auror retail crime intelligence-sharing platform. Between March 2023 and September 2024, MPS officers and staff used Auror without formal approval, creating around 500 accounts, of which 375 were active. Between January and September 2024, personal data on 179 individuals, three of them under 18, was uploaded to the unvetted platform. The ICO found four infringements and warned the wider policing sector that innovation must not outpace data protection obligations.

Detalhes técnicos

  • Uploaded data included names, dates of birth and home addresses.
  • Two internal security incident reports were raised. In the first, an officer uploaded the full names of suspects recognized in retailer-supplied CCTV images. In the second, officers were flagged for using the platform to collect CCTV images from retailers although the MPS cybersecurity team had not approved Auror.
  • Auror offers incident summaries, case management, data visualisation, reporting and a "Connect the Dots" module that uses image matching and manual suggestions to link events and individuals.
  • ICO findings: (1) unlawful processing without consent where sharing was not necessary for law enforcement purposes; (2) failure to implement appropriate technical and organizational measures and to follow assessment and approval processes for third-party technologies; (3) failure to complete a data protection impact assessment (DPIA) before high-risk processing; (4) continuing failure to ensure only approved third-party technologies process personal information.
  • The article describes no external attacker, malware or exploitation. This is an internal governance and shadow-IT failure.

Remediação

  • The ICO issued an enforcement notice requiring the MPS to address the continuing failure to restrict processing to approved third-party technologies.
  • Organizations should assess risks, complete a DPIA and obtain security approval before adopting new platforms that process personal data, and maintain effective oversight of their use.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 15/10/2026 05:30 · coletado 20/10 16:31 primeiro registro

    ICO reprimands Metropolitan Police over unapproved use of Auror platform that exposed personal data of 179 people

    ler a análise desta fonte

    The UK Information Commissioner's Office (ICO) has issued a reprimand and an enforcement notice to the Metropolitan Police Service (MPS) over governance failures in its use of the third-party Auror retail crime intelligence-sharing platform. Between March 2023 and September 2024, MPS officers and staff used Auror without formal approval, creating around 500 accounts, of which 375 were active. Between January and September 2024, personal data on 179 individuals, three of them under 18, was uploaded to the unvetted platform. The ICO found four infringements and warned the wider policing sector that innovation must not outpace data protection obligations.

    Technical Details

    • Uploaded data included names, dates of birth and home addresses.
    • Two internal security incident reports were raised. In the first, an officer uploaded the full names of suspects recognized in retailer-supplied CCTV images. In the second, officers were flagged for using the platform to collect CCTV images from retailers although the MPS cybersecurity team had not approved Auror.
    • Auror offers incident summaries, case management, data visualisation, reporting and a "Connect the Dots" module that uses image matching and manual suggestions to link events and individuals.
    • ICO findings: (1) unlawful processing without consent where sharing was not necessary for law enforcement purposes; (2) failure to implement appropriate technical and organizational measures and to follow assessment and approval processes for third-party technologies; (3) failure to complete a data protection impact assessment (DPIA) before high-risk processing; (4) continuing failure to ensure only approved third-party technologies process personal information.
    • The article describes no external attacker, malware or exploitation. This is an internal governance and shadow-IT failure.

    Remediation

    • The ICO issued an enforcement notice requiring the MPS to address the continuing failure to restrict processing to approved third-party technologies.
    • Organizations should assess risks, complete a DPIA and obtain security approval before adopting new platforms that process personal data, and maintain effective oversight of their use.