MPS reprimanded by ICO over information governance failures

The ICO’s investigation found that MPS officers and staff used the retail crime intelligence-sharing platform between March 2023 and September 2024, despite it not being formally approved for use by the force.

Around 500 accounts were created, with 375 actively used for policing activities. The investigation found that between January and September 2024 personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting. This included names, dates of birth and, in a small number of cases, home addresses.

David Doodson, ICO Head of Investigations said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.

“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.”

The  ICO found the MPS:

• Unlawfully processed personal information without the individual’s consent and where sharing was not necessary for law enforcement purposes;
• Failed to implement appropriate technical and organisational measures to protect personal information and ensure that assessment and approval processes for third-party technologies were followed;
• Failed to complete a data protection impact assessment before undertaking high-risk processing; and
• Continues to fail to implement appropriate measures to ensure that only approved third-party technologies are used to process personal information.

Mr Doodson added: “This action should send a message across the policing sector, and beyond: if you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.

“Where organisations fail to protect people’s information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”

A MPS spokesperson said as soon as they became aware of the issues they immediately suspended access to the platform and carried out a full review.

The MPS suspended use of the platform in September 2024 and implemented a range of improvements and safeguards prior to reintroducing it in January 2026.

These safeguards included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment. However, the ICO concluded that regulatory action was still required to address wider governance concerns relating to the use of third-party technologies by the MPS.

The enforcement notice requires the force to strengthen its approach to identifying, assessing and approving third-party services used to process personal information. It must also review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of the measures it has in place. The MPS is required to provide periodic updates to the ICO on its implementation of the requirements set out in the enforcement notice.

The MPS spokesperson added that they accept the ICO’s findings that data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.

“While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used,” they said.

The platform helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting.