MPS reprimanded by ICO over information governance failures

The ICO’s investigation found that MPS officers and staff used the retail crime intelligence-sharing platform between March 2023 and September 2024, despite it not being formally approved for use by the force.

Around 500 accounts were created, with 375 actively used for policing activities. The investigation found that between January and September 2024 personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting. This included names, dates of birth and, in a small number of cases, home addresses.

David Doodson, ICO Head of Investigations said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.

“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.”

The  ICO found the MPS:

• Unlawfully processed personal information without the individual’s consent and where sharing was not necessary for law enforcement purposes;
• Failed to implement appropriate technical and organisational measures to protect personal information and ensure that assessment and approval processes for third-party technologies were followed;
• Failed to complete a data protection impact assessment before undertaking high-risk processing; and
• Continues to fail to implement appropriate measures to ensure that only approved third-party technologies are used to process personal information.

Mr Doodson added: “This action should send a message across the policing sector, and beyond: if you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.

“Where organisations fail to protect people’s information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”

A MPS spokesperson said as soon as they became aware of the issues they immediately suspended access to the platform and carried out a full review.

The MPS suspended use of the platform in September 2024 and implemented a range of improvements and safeguards prior to reintroducing it in January 2026.

These safeguards included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment. However, the ICO concluded that regulatory action was still required to address wider governance concerns relating to the use of third-party technologies by the MPS.

The enforcement notice requires the force to strengthen its approach to identifying, assessing and approving third-party services used to process personal information. It must also review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of the measures it has in place. The MPS is required to provide periodic updates to the ICO on its implementation of the requirements set out in the enforcement notice.

The MPS spokesperson added that they accept the ICO’s findings that data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.

“While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used,” they said.

The platform helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting.

Auror VP Trust and Safety and Global Law Enforcement Partnerships Nick McDonnell said the platform is used by many police forces across the UK and provides them with “secure, safeguarded and compliant access to retailer-reported information about crime in their stores”.

He added: “The MPS formally approved the use of Auror earlier this year. The force’s current use of Auror has resulted in a quadrupling of its positive outcome rate (charges, arrests or justice-based outcomes) for shoplifting across London. It has supported stronger partnerships with high street retailers to crackdown on prolific and organised offenders.

“Unrelated to the MPS’s current use of Auror, we understand it received a reprimand notice from the ICO related to a period of use of the platform in 2023 and 2024, prior to the Met completing its own internal data governance processes. These processes have been successfully completed for some time now, with the Auror platform formally re-enabled and in operational use.

“The ICO has confirmed that there is no infringement or reprimand notice against Auror itself and Commission has not made any adverse findings in relation to the MPS’s current use of the Auror platform.”