Metropolitan Police reprimanded for unlawful Auror platform use

The Information Commissioner’s Office has issued a reprimand and enforcement notice to the Metropolitan Police Service for multiple data protection failures related to its use of the Auror platform. David Doodson, the ICO head of investigations, stated that police forces must have robust safeguards to protect sensitive personal information.

The ICO found four infringements by the Metropolitan Police. These were the unlawful processing of personal information without consent or necessity, a failure to implement appropriate technical and organizational measures, a failure to complete a data protection impact assessment before high-risk processing, and a continued failure to ensure only approved third-party technologies are used. Doodson said organizations cannot allow innovation to outpace data protection responsibilities. He added that the action should send a message across policing and beyond that using new technology to process personal information must be done lawfully, transparently, and with appropriate governance from the outset.

Unauthorised use of Auror platform by MPS

Between March 2023 and September 2024, hundreds of Metropolitan Police officers used the Auror retail crime intelligence platform without formal approval, leading to the upload of sensitive personal data. The platform was used in a crackdown on shoplifting. Some 500 Metropolitan Police accounts were created on Auror, of which 375 were active.

Two internal security incident reports were raised at the time regarding Auror use. In the first incident, an officer uploaded full names of suspects recognized in CCTV images shared by a retailer. In the second incident, officers were flagged for using Auror to collect CCTV images from retailers despite a lack of approval from the force's cybersecurity team.

Impact on individuals and subsequent actions

The platform was used to process personal information of 179 people, including three minors, before being suspended in September 2024 and later reintroduced in 2026 after reforms. Between January and September 2024, personal information including names, dates of birth, and home addresses relating to those 179 people was uploaded to Auror.

The Metropolitan Police Service suspended use of the platform in September 2024. It reintroduced the platform in January 2026 after implementing improvements. Those improvements included stronger governance arrangements, additional staff training, formal contractual controls, and completion of a data protection impact assessment.

The enforcement notice requires the Metropolitan Police Service to strengthen its approach to identifying, assessing, and approving third-party services. The force must review its controls, improve governance processes, enhance staff awareness, and regularly test the effectiveness of measures.

Auror platform capabilities and claimed benefits

Auror provides high-level summaries of incidents, case management, data visualisation and reporting, and a Connect the Dots module using image matching and manual suggestions. The platform has been lauded as quadrupling the number of shoplifters brought to justice in London.

The Information Commissioner’s Office is the UK’s independent regulator for data protection and information rights law. It acts on behalf of the Information Commission, which holds statutory powers to regulate information rights. The ICO can take action including criminal prosecution, non-criminal enforcement, and audit. Members of the public can report concerns via the ICO website or its helpline.

The Metropolitan Police Service must provide periodic updates to the ICO on its implementation of the enforcement notice requirements.