UK Watchdog Penalizes Met Police for Unchecked Use of Retail Crime Platform Auror

The Information Commissioner's Office (ICO) has issued an enforcement notice to London's Metropolitan Police Service (MPS) after finding that officers used a retail crime platform without authorization. According to The Register, the watchdog reprimanded the force for failing to conduct required data protection checks before allowing personnel to access Auror.

Between March 2023 and September 2024, MPS officers registered approximately 500 free accounts on Auror, a service used by retailers to record incidents like shoplifting. The force had not formally procured the service or established data-sharing agreements with Auror Europe, the UK subsidiary of the New Zealand-based company.

Operational Failures and Regulatory Response

The ICO determined that the police failed to complete a data protection impact assessment (DPIA) for the platform. Retailers, including supermarkets, encouraged officers to use Auror to access CCTV footage, but the force did not implement proper oversight. Internal security reports filed in August and September 2024 highlighted concerns about officers uploading suspect names and collecting footage without verification.

Access to Auror was blocked on September 26, 2024, after these internal reports raised alarms. The MPS data protection officer informed the ICO of the unauthorized use in December 2024 during discussions about a separate matter. The watchdog launched a formal probe into the incident in April 2025, leading to the recent enforcement action.

Scope of Data Exposure

The investigation found that officers unlawfully uploaded personal data relating to 179 people to the platform. This group included three children, raising additional privacy concerns for minors. The data uploaded varied in sensitivity, with names alone recorded for 128 individuals.

For 49 people, the uploaded information included both names and dates of birth. In two cases, officers uploaded names, dates of birth, and home addresses. The ICO's findings indicate a significant breach of data handling protocols, as the force allowed sensitive personal information to be stored on an unvetted third-party service without legal safeguards.

What should you do?

Organizations should audit their use of third-party platforms to ensure all data processing activities are formally approved and documented. Security teams must verify that vendors have completed necessary privacy assessments before sharing sensitive information.

What to do and how to stay safe: Auror

• Review internal policies to ensure all third-party software integrations undergo formal procurement and privacy impact assessments before use.
• Audit existing accounts on external platforms to identify any unauthorized registrations or data uploads that bypassed corporate approval.
• Monitor official channels for updates from the ICO regarding enforcement actions and compliance requirements for public sector data handling.
• Ensure that data-sharing agreements are established with all vendors before exchanging personal information, particularly involving minors or sensitive identifiers.

Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many people were affected by the Met Police's use of Auror?

The ICO found that personal data relating to 179 people, including three children, was unlawfully uploaded to the platform.

What type of data was uploaded to the platform?

Data included names for 128 people, names and dates of birth for 49 people, and names, dates of birth, and home addresses for two people.

When was access to Auror blocked by the Met Police?

Access to the platform was blocked on September 26, 2024, following internal security reports about unauthorized usage.