A Breach of Oversight in London
The Metropolitan Police Service (MPS) has faced formal reprimand and enforcement action from the Information Commissioner's Office (ICO) following the discovery that its officers were utilizing a retail crime-tracking platform without necessary oversight, legal vetting, or corporate approval. The platform in question, Auror, is a tool designed to allow retailers to share incident reports, high-resolution imagery, and CCTV footage to combat shoplifting. While the intention behind its use was to streamline evidence sharing, the lack of institutional governance turned a policing tool into a significant data privacy liability.
Between March 2023 and September 2024, MPS officers independently registered approximately 500 accounts on the platform. During this period, the force failed to conduct a Data Protection Impact Assessment (DPIA) or establish formal data-sharing agreements with the company. By the time the practice was suspended in September 2024, officers had unlawfully uploaded the personal data of 179 individuals into the system—including the names, dates of birth, and home addresses of several children.
The ICO’s Critique of Institutional Controls
The ICO’s investigation highlighted a systemic issue within the Metropolitan Police regarding the adoption of third-party software. The watchdog noted that the force relies too heavily on "soft controls"—such as internal training and policy reminders—which proved insufficient in preventing unauthorized software usage. Furthermore, the MPS lacked the technical safeguards required to detect or block such activity, allowing officers to operate on an unapproved platform for over 18 months without triggering a single alert.
This is not the first time the MPS has come under fire for improper technology adoption. The ICO pointed to a recurring pattern of failure, referencing the force's unauthorized use of Clearview AI in 2021 as a past example of inadequate oversight. The regulator's enforcement notice now mandates that the Metropolitan Police strengthen its technological safeguards and provide the ICO with periodic progress updates to ensure compliance with data protection laws.
Why It Matters
- Data Protection Standards: The case reinforces that law enforcement agencies are not exempt from the rigorous data protection requirements mandated for all organizations processing public information.
- Third-Party Risks: The incident highlights the dangers of "shadow IT" in public sector environments, where individual employees might prioritize immediate efficiency gains over long-term security and legal protocols.
- Regulatory Precedent: By issuing an enforcement notice, the ICO is setting a clear standard for the policing sector, emphasizing that the adoption of new, efficient tech must be balanced with transparency and institutional accountability.
Path to Formal Compliance
In response to the investigation, the Metropolitan Police has shifted from an unapproved, ad-hoc arrangement to a structured, fully vetted integration. According to an official statement, the force has since conducted the necessary legal, commercial, and security checks required for the platform. As of late 2026, the service is now officially deployed across 14 London boroughs, with reports suggesting that the platform has significantly contributed to higher positive outcome rates for shoplifting cases reported by major retailers like Tesco, Boots, and M&S.
While the force acknowledges the insufficiency of its past arrangements, the incident serves as a stark reminder of the complexities inherent in modern policing. Balancing the need for rapid digital transformation with the protection of civil liberties remains a core challenge, especially as departments look toward integrated data platforms to tackle localized crime.
