ICO Reprimands Met Over Third-Party Data Leak

The UK’s data protection regulator has issued a reprimand and enforcement notice to the capital’s police force after a string of governance failings related to its use of a third-party platform.

The investigation by the Information Commissioner’s Office (ICO) was focused on Metropolitan Police Service (MPS) use of the Auror retail crime intelligence-sharing platform, which it used in a crackdown on shoplifting.

The watchdog found that, between March 2023 and September 2024, MPS officers and staff used the platform despite it not being formally approved. Some 500 MPS accounts were created, of which 375 were active, it said in its writeup of the case.

Auror provides high-level summaries of incidents, case management, data visualisation and reporting, and a “Connect the Dots” module, which uses image matching and manual suggestions to identify links between events and individuals. It has been lauded as quadrupling the number of shoplifters brought to justice in London.

However, the ICO said that between January and September 2024 personal information including names, dates of birth and home addresses relating to 179 people – three of whom were under 18 – was uploaded to the unvetted platform.

Read more on MPS privacy woes: ICO Reprimands Metropolitan Police for Data Snafu

Two “security incident reports” were raised internally at the time. In the first, an officer uploaded the full names of suspects they recognized in CCTV images shared by a retailer. In the second, officers were flagged as using the platform to collect CCTV images from retailers despite Auror not having been approved by the MPS cybersecurity team.

The ICO found four infringements. It said the MPS:

• Unlawfully processed personal information without the individual’s consent and where sharing wasn’t necessary for law enforcement purposes
• Failed to implement “appropriate technical and organizational measures” to protect personal information and follow proper assessment and approval processes for third-party technologies
• Failed to complete a data protection impact assessment (DPIA) before undertaking high-risk processing
• Continues to fail to implement appropriate measures to ensure only approved third-party technologies are used to process personal information

David Doodson, ICO head of investigations, said police forces must have robust safeguards in place to protect the large volumes of sensitive personal information they handle.

“Organizations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight,” he added.

“This action should send a message across the policing sector, and beyond: if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset.”