UK Data Regulator Reprimands Metropolitan Police Over Unapproved Auror Platform Use

The Information Commissioner’s Office has issued a formal reprimand and enforcement notice to the Metropolitan Police Service regarding serious governance failures. According to Infosecurity Magazine, the UK data protection regulator took action after discovering that police officers used the third-party Auror platform without formal approval. This investigation focused on how the capital’s police force handled sensitive data during a crackdown on retail crime, revealing significant lapses in data protection protocols and third-party vendor management procedures.

Between March 2023 and September 2024, the Metropolitan Police Service created approximately 500 accounts for the Auror platform, with 375 of those accounts remaining active. Infosecurity Magazine reports that the ICO found officers and staff used the system despite it not being formally approved by the force. The platform, which provides incident summaries and data visualization tools, was utilized for shoplifting investigations. However, the regulator determined that this usage occurred without the necessary technical and organizational safeguards required for processing personal information.

Regulatory Findings and Data Breaches

The ICO identified that personal information for 179 people, including three minors, was uploaded to the unvetted platform between January and September 2024. This data included sensitive details such as names, dates of birth, and home addresses. Infosecurity Magazine notes that two internal security incident reports were raised at the time. In one instance, an officer uploaded full names of suspects recognized in CCTV images shared by a retailer. In another, officers were flagged for collecting CCTV images via the platform despite it lacking approval from the MPS cybersecurity team.

The watchdog cited four specific infringements in its final writeup of the case. The Metropolitan Police unlawfully processed personal information without consent and where sharing was not necessary for law enforcement purposes. The force also failed to implement appropriate technical and organizational measures to protect data and did not follow proper assessment processes for third-party technologies. Additionally, the MPS failed to complete a data protection impact assessment before undertaking this high-risk processing activity.

Impact on Police Operations

Auror is a retail crime intelligence-sharing platform that offers case management and a “Connect the Dots” module for identifying links between events. Infosecurity Magazine reports that the platform has been praised for quadrupling the number of shoplifters brought to justice in London. Despite these operational benefits, the ICO emphasized that innovation cannot outpace data protection responsibilities. David Doodson, the ICO head of investigations, stated that police forces must maintain robust safeguards to protect the large volumes of sensitive personal information they handle daily.

The enforcement notice requires the Metropolitan Police to address these ongoing failures. The regulator found that the force continues to fail in implementing appropriate measures to ensure only approved third-party technologies are used. This case highlights the tension between rapid technological adoption in law enforcement and the strict legal requirements for data privacy and security compliance in the UK.

What should you do?

Organizations using third-party platforms for data processing should immediately audit their vendor approval processes. Security teams must verify that all software handling personal data has undergone a formal risk assessment. It is critical to ensure that data protection impact assessments are completed before any high-risk processing begins. Additionally, internal security incident reports should be reviewed to identify any unvetted systems currently in use.

What to do and how to stay safe: Metropolitan Police

• Audit all third-party applications currently in use to verify they have formal security and privacy approvals.
• Ensure a data protection impact assessment is completed before deploying any new tool that processes personal information.
• Review internal security incident logs to identify any previous reports of unapproved software usage by staff.
• Verify that technical and organizational measures are in place to prevent unauthorized data uploads to external platforms.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many people were affected by the data leak on the Auror platform?

Personal information for 179 individuals, including three people under the age of 18, was uploaded to the unvetted platform.

What specific infringements did the ICO find against the Metropolitan Police?

The ICO found four infringements, including unlawful processing of data, failure to implement protective measures, and lack of a data protection impact assessment.

Did the Metropolitan Police approve the Auror platform before using it?

No, the ICO found that officers used the platform between March 2023 and September 2024 despite it not being formally approved by the force.