ICO reprimands Met Police over use of unapproved Auror retail crime data-sharing platform
The UK Information Commissioner's Office (ICO) issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after officers and staff shared personal information through the unapproved third-party platform Auror without adequate data protection safeguards. The platform was used between March 2023 and September 2024, with about 500 MPS accounts created and 375 actively used. Between January and September 2024, officers uploaded personal data on 179 individuals suspected of shoplifting, including three minors. The ICO found four infringements and concluded that the force still lacks adequate measures to ensure only approved third-party technologies process personal information.
Technical Details
- Auror is a retail crime intelligence-sharing platform with incident summaries, case management, data visualisation and a "Connect the Dots" feature that uses image matching and manual suggestions to link incidents and individuals.
- Data uploaded included names, dates of birth and, in a small number of cases, home addresses.
- Two internal security incident reports were raised: one for an officer uploading full names of suspects identified in retailer CCTV footage, the other for officers using the platform to obtain retailer CCTV images without approval from the force's cybersecurity team.
- The four infringements covered unlawful processing without consent where sharing was not necessary for law enforcement purposes, failure to implement appropriate technical and organisational measures, failure to follow third-party technology assessment and approval processes, and no data protection impact assessment before high-risk processing.
- The MPS suspended Auror in September 2024 and reintroduced it in January 2026 after improving governance, training, contractual controls and completing a DPIA.
Remediation
- Under the enforcement notice, the MPS must strengthen procedures for identifying, assessing and approving external services that process personal information.
- The force must review existing controls, improve governance, raise staff awareness of data protection requirements and regularly test the effectiveness of its safeguards.
- The MPS must provide the ICO with periodic progress updates.
Linha do tempo
-
ICO reprimands Met Police over use of unapproved Auror retail crime data-sharing platform
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after officers and staff shared personal information through the unapproved third-party platform Auror without adequate data protection safeguards. The platform was used between March 2023 and September 2024, with about 500 MPS accounts created and 375 actively used. Between January and September 2024, officers uploaded personal data on 179 individuals suspected of shoplifting, including three minors. The ICO found four infringements and concluded that the force still lacks adequate measures to ensure only approved third-party technologies process personal information.
Technical Details
- Auror is a retail crime intelligence-sharing platform with incident summaries, case management, data visualisation and a "Connect the Dots" feature that uses image matching and manual suggestions to link incidents and individuals.
- Data uploaded included names, dates of birth and, in a small number of cases, home addresses.
- Two internal security incident reports were raised: one for an officer uploading full names of suspects identified in retailer CCTV footage, the other for officers using the platform to obtain retailer CCTV images without approval from the force's cybersecurity team.
- The four infringements covered unlawful processing without consent where sharing was not necessary for law enforcement purposes, failure to implement appropriate technical and organisational measures, failure to follow third-party technology assessment and approval processes, and no data protection impact assessment before high-risk processing.
- The MPS suspended Auror in September 2024 and reintroduced it in January 2026 after improving governance, training, contractual controls and completing a DPIA.
Remediation
- Under the enforcement notice, the MPS must strengthen procedures for identifying, assessing and approving external services that process personal information.
- The force must review existing controls, improve governance, raise staff awareness of data protection requirements and regularly test the effectiveness of its safeguards.
- The MPS must provide the ICO with periodic progress updates.