The UK Information Commissioner’s Office has reprimanded the Metropolitan Police Service and issued an enforcement notice after officers used the Auror retail crime platform without formal approval or data protection checks. The regulator’s action was published on October 15.
Hundreds of Officer Accounts Created Without Approval
Between March 2023 and September 2024, about 500 accounts on the Auror platform were created by Met officers, of which 375 were active. The ICO found that the force had not completed a data protection impact assessment and had no data-sharing agreements with Auror Europe. Retailers such as supermarkets encouraged officers to use the platform, which police can access for free.
179 People’s Details Uploaded, Three of Them Under 18
Between January and September 2024, officers uploaded the names, dates of birth and home addresses of 179 people to Auror. Three of those people were under 18. The data came from officers’ own work and was placed on a third-party commercial platform without the approvals that would normally govern such sharing.
Internal Reports Flagged Suspect Names and CCTV Pulls on the Auror Platform
Two internal security incident reports in August and September 2024 flagged officers uploading suspect names and pulling retailer CCTV footage through the platform. The Met blocked access on September 26, 2024. Its data protection officer then informed the ICO in December 2024, about three months after access was cut.
From Block to Regulator: A Timeline of the Met’s Response
The sequence ran from the two internal reports in the late summer of 2024, to the block on September 26, to notification of the regulator in December. The ICO’s formal reprimand and enforcement notice came in October 2026, roughly two years after the Met disclosed the issue. The sources do not explain the length of the ICO’s review.
A Reprimand Plus a Requirement for Corrective Steps
The ICO issued both a formal reprimand and an enforcement notice. The reprimand records the regulator’s criticism, while the enforcement notice requires the Met to take corrective steps. The sources do not list those steps or give a compliance deadline.
The use of an enforcement notice alongside a reprimand is notable because a notice carries legal force, and failing to comply can lead to further regulatory action. The sources do not report a monetary penalty.
Unchecked Platform Use or Third-Party Leak: How Coverage of the Auror Case Differs
Coverage of the case differs in framing. The Register describes it as unchecked use of a platform by police, while Infosecurity Magazine presents it as a third-party data leak. The distinction affects what the case is understood to show. The ICO’s findings, as reported, describe officers choosing to upload data to a platform without approval and not an attacker or a vendor failure exposing information. Nothing in the sources indicates that Auror was breached or that outsiders obtained the uploaded data.
Governance Gaps in the Met’s Adoption of Auror
The case illustrates a governance failure in how a police force handled a free commercial tool offered by retailers. The tool was easy to adopt: officers could sign up, nobody tied the access to a formal assessment, and retailers encouraged use. A free service that arrives from outside the organization can spread through a workforce faster than the approval process meant to review it.
Data protection law expects an organization to assess the risk of a new data-sharing arrangement before personal data moves. The ICO’s findings turn on the missing assessment and the missing agreements with Auror Europe, not on any evidence of misuse by Auror.
The involvement of three minors in the 179 uploaded records adds sensitivity to the uploads, since children’s data attracts particular attention in UK data protection enforcement. The sources do not say what the Met has done with the uploaded records since access was blocked.
