The Metropolitan Police has been reprimanded by the data watchdog after officers unlawfully shared personal information on an unapproved third-party platform used to track suspected shoplifters.
The Information Commissioner’s Office (ICO) issued the force with both a reprimand and an enforcement notice after finding serious failings in how it used the Auror crime intelligence platform between March 2023 and September 2024.
What happened
Met officers and staff used the Auror platform — designed to help retailers share evidence and identify suspected shoplifters — despite it never being formally approved for use by the force.
Around 500 accounts were created, with 375 actively used for policing activities, according to the ICO’s investigation. Between January and September 2024, personal information relating to 179 people — including three under the age of 18 — was uploaded to the platform.
The data included names, dates of birth and, in a small number of cases, home addresses.
“Insufficient” safeguards
The ICO found that the Met had unlawfully processed personal information without the individuals’ consent, and that the sharing was not necessary for law enforcement purposes.
The force had failed to take appropriate technical and organisational measures to protect personal information. It had not completed a data protection impact assessment before undertaking the high-risk processing, and had not ensured that only approved third-party technologies were used.
The Met has accepted the findings. A spokesman said: “We accept the ICO’s findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.”
“While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used.”
Immediate suspension
As soon as the issue came to light, the Met suspended access to the platform and carried out a full review. Stronger governance arrangements, additional staff training, formal contractual controls and a data protection impact assessment were among the new safeguards introduced.
The platform was formally approved and reintroduced in January 2026. It is now used in 14 London boroughs, where the Met says it “helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting.”
“A message across the policing sector”
David Doodson, the ICO’s head of investigations, said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.”
“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.”
“This action should send a message across the policing sector, and beyond. If you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.”
Part of a wider pattern
The Auror case is the latest in a series of data protection failures at the Met. The ICO previously issued an enforcement notice over separate incidents — including one where a stalking victim’s new contact details were shared with her alleged abuser, and another where email addresses were exposed in a bulk-email blunder.
The London Assembly has heard that only 30 per cent of Met officers have completed mandatory data protection training, with the force’s director of strategy and oversight conceding the figure “wasn’t particularly good” and needs improvement.
For a force that handles some of the most sensitive personal data in the country — from stalking victims to witnesses to people under investigation — the findings raise serious questions about whether data protection is being treated with the urgency it demands.
The ICO’s enforcement notice requires the Met to take specific steps to improve its data protection practices. The force now faces close scrutiny to ensure that the governance failures that allowed unapproved technology to process personal data for 18 months are not repeated.
London Streets has covered other data security stories and developing news across the capital.
