The UK’s data protection regulator, the Information Commissioner’s Office (ICO), has issued a reprimand and an enforcement notice to London’s Metropolitan Police Service (the Met) after officers used a retail-crime platform without the force’s approval or proper data protection checks. The ICO announced the action on 14 October 2026. It did not issue a fine.
The ICO’s notice, dated 23 September 2026, names the platform as one provided by Auror Europe Limited, a subsidiary of New Zealand’s Auror. Retailers use Auror to share reports of crimes such as shoplifting.
What the ICO found
According to the ICO, Met officers and staff used the platform “between March 2023 and September 2024, despite it not being formally approved for use by the force.” “Around 500 accounts were created, with 375 actively used for policing activities,” the regulator said.
Between January and September 2024, “personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform” to help identify people suspected of shoplifting, the ICO said. The notice says this was names only for 128 people, names and dates of birth for 49, and names, dates of birth and home addresses for two.
The ICO found that the Met processed personal information unlawfully, did not have proper safeguards, and did not carry out a data protection impact assessment before high-risk processing. It also found the Met “continues to fail to implement appropriate measures to ensure that only approved third-party technologies are used to process personal information.” The notice points to an earlier ICO reprimand over officers’ use of Clearview AI’s facial recognition platform.
“Organisations cannot allow innovation to outpace their data protection responsibilities,” said David Doodson, the ICO’s Head of Investigations. “If you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.”
What the Met must do
The Met suspended use of the platform in September 2024 and brought it back in January 2026 after adding safeguards, including stronger governance, staff training, contracts and a data protection impact assessment, the ICO said. But the regulator said action was still needed on wider governance. The enforcement notice requires the Met to tighten how it assesses and approves third-party services, review its controls, improve staff awareness, regularly test its measures and send the ICO periodic updates.
The Met’s response
A Met spokesperson told The Register: “We accept the ICO’s findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.” The spokesperson said that “following formal approval and a pilot, the platform is now used in 14 London boroughs,” The Register reported.
What this means
- No fine, but formal action. The Met must make changes and report back to the regulator.
- Officers can’t just sign up to tools. Police need approval and checks before using outside platforms.
- The platform is back. The Met is using Auror again, now with safeguards in place.
Sources
- Information Commissioner’s Office, “ICO takes action against Metropolitan Police Service over information governance failures”, 14 October 2026. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-takes-action-against-metropolitan-police-service-over-information-governance-failures/
- Information Commissioner’s Office, Metropolitan Police Service reprimand and enforcement notice, 23 September 2026. https://ico.org.uk/media2/a5tcelok/metropolitan-police-service-reprimand-and-enforcement-notice.pdf
- The Register, “Metropolitan Police’s unchecked use of shoplifting platform lands force in trouble with data watchdog”, Connor Jones, 15 October 2026. https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061
