The data protection watchdog the ICO has reprimanded the Metropolitan Police for numerous failings around its use of a platform for retailers in business crime reduction partnerships to pass on and share crime data.
The platform was ‘not corporately procured, approved or adopted’ by the Met and ‘the [ICO] Commissioner has not been provided with any evidence that a contract, information sharing agreement or other arrangement relating to the processing of personal data was put in place’. About 500 Met accounts were created on the platform of which 375 were active and were used by officers and staff. The Met ‘was unable to provide’ an audit trail.
David Doodson, ICO Head of Investigations said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it. Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.
“This action should send a message across the policing sector, and beyond: if you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.ย Where organisations fail to protect people’s information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”
The Information Commissioner’s Office (which meanwhile has ‘formally transitioned’ to the Information Commission and has a new Manchester office) noted the Met suspended use of the Auror platform (used across the English speaking world by retailers and police) in September 2024 and implemented improvements and safeguards before reintroducing it in January 2026. It was made available to the Met as a pilot in 2023. It’s been used, the ICO found, for example ‘to facilitate the review of CCTV’ in stores.
Those safeguards included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment. However, the ICO concluded that regulatory action was still required to address wider governance concerns relating to the use of third-party technologies by the Met; hence a reprimand.
Strategy
The Met meanwhile has launched a public consultation on an Inclusion Strategy which the force says is designed to help tackle crime, better protect victims and strengthen trust and confidence across the city’s communities.
Photo by Mark Rowe: Met Police station, north London
