ICO reprimands Met Police over unapproved use of retail crime platform
The Information Commissioner’s Office has reprimanded the Metropolitan Police and issued an enforcement notice after officers used the Auror retail crime platform without formal approval or required data protection checks. The case highlights gaps in the force’s oversight of third-party technology and raises concerns about how people’s personal information is handled.
Between March 2023 and September 2024, officers created around 500 free Auror accounts. The ICO found that personal data belonging to 179 people, including three children, was uploaded: 128 records contained names, 49 also included dates of birth, and two included home addresses. The Met blocked access in September 2024, but says that after tighter controls and a pilot, officers in 14 London boroughs are using the platform again; the force says it has quadrupled positive shoplifting outcomes.
- The ICO found the Met uploaded data on 179 people to Auror unlawfully.
- Officers used the platform for more than 18 months without an alert.
- The Met says tighter controls now govern use in 14 boroughs.
New here? Start with this
The Metropolitan Police, often called the Met, is the police force responsible for Greater London. Auror is a digital platform used by retailers and police to share information about suspected shoplifting and related incidents.
Police handling of personal information is subject to data protection rules, including checks on how new technology will be used and who can access the information. The Information Commissioner’s Office (ICO) oversees those rules in the UK and can take action when organisations do not meet them. This case raises questions about how police forces approve and oversee technology supplied by outside companies.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The platform may help police and retailers share information about repeat thefts, identify suspects and resolve more shoplifting cases, potentially improving public safety and reducing losses to local businesses. The Met’s reported increase in positive outcomes suggests there may be practical value, provided use is properly authorised and safeguards are in place.
The case against
Police handling of personal data requires clear approval, checks and accountability, especially when records include children or sensitive identifying details. Using a third-party platform without those safeguards risks inaccurate or excessive data being shared and can undermine public trust, so improved outcomes do not remove the need for strict oversight.
Read the full article at the source →
Originally published by The Register as “Metropolitan Police’s unchecked use of shoplifting platform lands force in trouble with data watchdog”.