The Information Commissioner's Office has issued a formal reprimand to the Metropolitan Police Service. This follows a finding that officers uploaded personal data without authorization. The incident involved the use of a private retail crime platform. The breach occurred over an eighteen-month period. Data protection laws were clearly violated during this time.
Officers created approximately five hundred free accounts on Auror. They did this between March 2023 and September 2024. The force had not approved this specific software for official use. Consequently, no proper privacy impact assessments were conducted. This lack of oversight meant sensitive information was handled improperly.
The Auror platform is designed to share intelligence on suspected shoplifters. It allows retailers to flag individuals across different stores. However, the Met Police used it for operational purposes without consent. A total of 179 people had their details unlawfully uploaded. These individuals were not informed about the data sharing.
The ICO determined that the Met Police failed in its legal duties. The force did not ensure that data processing was lawful or transparent. Officers bypassed internal protocols to gain access to the system. This created a significant gap in data governance. The platform itself is not a law enforcement tool. It serves commercial interests primarily.
The investigation revealed a systemic failure in oversight. Line managers did not check the legitimacy of the accounts. There was no central registry of authorized software tools. This allowed individual officers to act independently. They believed the tool would help reduce retail crime. Yet, the method used was legally unsound.
The root cause was a lack of clear guidance. Officers were struggling with high volumes of retail crime reports. They sought faster ways to share information with shops. Auror offered a simple interface for this purpose. However, it lacked the security standards required for police data.
The ICO noted that the force failed to assess the risks. No contract existed between the Met Police and Auror. This meant there were no data processing agreements in place. Personal data was stored in a system not designed for public sector use. The legal basis for processing this data was absent.
The enforcement notice requires the Met Police to take corrective action. They must implement stricter controls on third-party software. All existing data on the platform must be reviewed. Any unlawfully held data must be deleted immediately. The force must also train staff on data protection laws.
Who was responsible for the data breach? Metropolitan Police officers were directly responsible for creating the accounts. They uploaded details without following required privacy checks. The force management failed to prevent this unauthorized activity.
What is the Auror platform used for? Auror is a private database that retailers use to share information about shoplifters. It allows stores to identify individuals who have stolen goods previously. It is not an official police system.
What penalties did the Met Police face? The ICO issued an enforcement notice and a formal reprimand. The force must now delete unlawfully held data. They are also required to improve their internal data protection controls.