UK Watchdog Cites Police for Data Leak Lapses

“Organizations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight,” David Doodson, ICO head of investigations, said.

ICO issues reprimand and enforcement notice to the Metropolitan Police Service

The Information Commissioner’s Office (ICO) has formally reprimanded and issued an enforcement notice to the Metropolitan Police Service (MPS) after an investigation into the force’s use of a third‑party retail crime intelligence platform. The action followed what the ICO described as a string of governance failings tied to MPS use of the Auror platform in a crackdown on shoplifting.

How the MPS used Auror and what the platform does

The ICO’s writeup documents that the MPS used Auror between March 2023 and September 2024 despite the platform not being formally approved. The watchdog recorded that some 500 MPS accounts were created on the service, of which 375 were active. Auror is described in the material as providing high‑level summaries of incidents, case management, data visualisation and reporting, and a “Connect the Dots” module that uses image matching and manual suggestions to identify links between events and individuals. The platform has been credited in reporting as quadrupling the number of shoplifters brought to justice in London.

Personal data uploaded and two internal security incident reports

The ICO found that between January and September 2024 personal information relating to 179 people was uploaded to the unvetted platform. That information included names, dates of birth and home addresses; three of the 179 people were under 18. Two internal “security incident reports” were raised at the time: in the first, an officer uploaded the full names of suspects they recognised in CCTV images shared by a retailer; in the second, officers were flagged as using the platform to collect CCTV images from retailers even though Auror had not been approved by the MPS cybersecurity team.

ICO’s four infringements identified

• The ICO found the MPS unlawfully processed personal information without individuals’ consent and where sharing was not necessary for law enforcement purposes.
• The watchdog concluded the force failed to implement appropriate technical and organisational measures to protect personal information and did not follow proper assessment and approval processes for third‑party technologies.
• The ICO said the MPS failed to complete a data protection impact assessment (DPIA) before undertaking high‑risk processing.
• The regulator found the MPS continues to fail to implement appropriate measures to ensure only approved third‑party technologies are used to process personal information.

What this means for the Metropolitan Police Service, technologists, and the public

• Metropolitan Police Service: The enforcement notice requires remedial action on governance, approval processes and technical safeguards; the ICO’s findings specifically require completion of DPIAs and tighter controls to prevent unapproved platforms from being adopted.
• Technologists and security teams: The ICO’s decision underscores the need to enforce approval workflows and cybersecurity sign‑off before operational use of third‑party platforms, and to ensure that image‑matching and data‑linking features are subject to data protection assessment.
• The public and affected individuals: Names, dates of birth and home addresses for 179 people—including three under 18—were uploaded to an unvetted system, a fact that raises privacy and transparency concerns for those whose data was processed.

David Doodson framed the ICO’s action as a wider signal to policing and other organisations that innovation cannot supplant legal and governance obligations. The enforcement notice and reprimand formalise the regulator’s findings and set specific expectations around risk assessment, DPIAs and approval controls for third‑party tools.

The record in this case combines operational enthusiasm for a tool credited with delivering measurable results in prosecutions with procedural gaps that the ICO judged unlawful. Whether the MPS implements the measures the ICO requires, and how quickly it closes the approval and oversight gaps, will determine how effectively the reprimand translates into changed practice across policing in London.

Original story: https://www.infosecurity-magazine.com/news/ico-reprimands-met-over-thirdparty/