Between March 2023 and September 2024, Metropolitan Police officers registered around 500 free accounts on Auror — a retail crime platform — without formal procurement or the required data-protection checks, the Information Commissioner’s Office has concluded.
How officers used the Auror platform
Auror Europe, a company registered in England and Wales and a subsidiary of New Zealand-based Auror, operates a browser and mobile app that lets retailers share incident reports, images and CCTV footage. Retailers paying for the service directed officers to the platform to access CCTV and encouraged police to use it. Police partners were provided free access.
Internal records show officers used Auror for more than 18 months without triggering web‑control alerts. Two separate internal security reports filed between August and September 2024 raised specific concerns: one about officers uploading the names of suspects they recognised from CCTV, and another about officers collecting CCTV footage from the platform despite no checks having been made on it. Access to Auror was blocked on September 26, 2024.
ICO findings: unlawful data uploads and governance gaps
The Information Commissioner’s Office (ICO) launched a formal probe in April 2025 after the MPS data protection officer informed the regulator in December 2024. The ICO found officers unlawfully uploaded personal data relating to 179 people to Auror, including three children. For 128 of those people the upload consisted of names only; for 49 it was names and dates of birth; and for two people the uploads included names, dates of birth and home addresses.
The ICO concluded the force had not completed a data protection impact assessment (DPIA) nor established data‑sharing agreements with Auror Europe. It said the MPS had failed to ensure adequate oversight when deciding which third‑party platforms officers were allowed to use and was “overly reliant on soft controls” such as policy reminders and training rather than technical blocks. The watchdog also said the force had not tested whether its web controls worked.
The regulator described the case as a repeat failure, pointing to officers’ use of Clearview AI in 2021 without proper oversight, and said the failures are ongoing because the force has not demonstrated that safeguards can prevent similar incidents.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEnforcement notice, ICO message and Met reaction
The ICO has issued a reprimand and an enforcement notice compelling the MPS to strengthen safeguards against improper use of third‑party tools and to provide periodic progress updates to the regulator. David Doodson, head of investigations at the ICO, said: “This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset. Where organisations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”
The MPS accepted the ICO’s findings and described officers as acting “in good faith to identify and arrest shoplifters.” A Met spokesperson told The Register: “We accept the ICO's findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform. … As soon as we became aware of this issue, we immediately suspended access to the platform and carried out a full review. We have subsequently completed the necessary legal, security, commercial and data protection checks before approving the platform for use.”
Metropolitan Police rollout and claimed outcomes
Following what the Met called the implementation of stricter controls and a pilot scheme, officers in 14 London boroughs began using Auror again, the force told The Register: “Following formal approval and a pilot, the platform is now used in 14 London boroughs.” In an August 2026 announcement the MPS said the technology — unnamed in that statement — would be rolled out beyond those boroughs and was already deployed in stores such as Tesco, Boots, Greggs and M&S. The force said instances of shoplifting reported via the platform result in a positive outcome in 29.4 percent of cases and that the tool “has quadrupled positive outcomes for shoplifting,” according to the Met spokesperson.
What this means for technologists, police procurement officers, and members of the public
- Technologists and security teams: the ICO highlighted a failure to test web controls and reliance on soft controls; technical teams will have to demonstrate that blocking and monitoring mechanisms are effective and that a DPIA and data‑sharing arrangements are in place before deployment.
- Police procurement and data protection officers: the case underscores the need for formal procurement, completed DPIAs and signed data‑sharing agreements before officers are given access to commercial platforms, not after access has become routine.
- Members of the public and victims: 179 people — including three children — had personal data uploaded without lawful checks; the enforcement notice requires the force to strengthen safeguards and report progress to the ICO, meaning affected individuals should expect remedial governance steps from the MPS.
The ICO’s action leaves two clear, concrete responsibilities: demonstrable technical and contractual safeguards before platforms are adopted, and regular, verifiable updates to the regulator. The MPS says it has completed legal, security, commercial and data‑protection checks and restarted limited use; the ICO has framed its enforcement as both a sanction and a corrective measure. Whether the new controls will be sufficient — and sufficiently tested — is now a matter the regulator has required the force to prove in periodic reports.
