Met accepts findings after watchdog criticises force on data protection failures
An ICO investigation found a number of failures and issued a reprimand and enforcement notice.
The Metropolitan Police has been reprimanded by the data watchdog after it shared personal information on an unapproved third-party site without appropriate data protection safeguards, governance or oversight.
The Information Commissioner’s Office (ICO) ordered the force to step up its data protection practices after it found failings in the way it used a crime intelligence platform to help trace and arrest suspected shoplifters.
Met Police officers and staff had used the Auror platform between March 2023 and September 2024, despite it not being formally approved for use by the force.
A number of failures
An ICO investigation found a number of failures and issued a reprimand and enforcement notice.
Among the failures was that the Met had unlawfully processed personal information without the individual’s consent and sharing was not necessary for law enforcement, the ICO found.
The Met accepts its data protection arrangements had been “insufficient in relation to individual officers using the Auror platform” and it “immediately suspended access to the platform and carried out a full review”.
Around 500 accounts were created, with 375 actively used for policing activities, according to the watchdog.
Between January and September 2024 personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform, according to the ICO investigation.
This included names, dates of birth and, in a small number of cases, home addresses.
The force had failed to take appropriate technical and organisational measures to protect personal information and ensure that assessment and approval processes for third-party technologies were followed.
It also did not complete a data protection impact assessment before undertaking high-risk processing and appropriate measures to ensure that only approved third-party technologies are used to process personal information were not introduced, the ICO said.
"Should send a message across the policing sector"
David Doodson, the ICO’s head of investigations, said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.
“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities.
“Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.
“This action should send a message across the policing sector, and beyond.
“If you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.”
The Met suspended use of the platform in September 2024 and bolstered its safeguards before reintroducing it in January 2026.
Stronger governance arrangements, additional staff training, formal contractual controls and a data protection impact assessment were among the new safeguards.
A Met spokesman said: “We accept the ICO’s findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.
“While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used.
“As soon as we became aware of this issue, we immediately suspended access to the platform and carried out a full review. We have subsequently completed the necessary legal, security, commercial and data protection checks before approving the platform for use.”
The platform, which has been formally approved and trialled, is now used in 14 London boroughs.
The spokesman said: “It helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting.”