Met Police officers used Auror crime platform without approval, ICO finds

The UK Information Commissioner's Office has reprimanded the Metropolitan Police Service over data protection failures involving unauthorised third-party technology, after officers and staff used Auror, a retail crime intelligence platform, without formal organisational approval.

The scale of the unauthorised use is documented. Between March 2023 and September 2024, approximately 500 police accounts were created on the platform, with 375 actively used. Personal information relating to 179 individuals, including three minors, was uploaded. The watchdog found that names, dates of birth and some residential addresses were processed without adequate safeguards.

Crucially, the force failed to conduct the required Data Protection Impact Assessment before using the system. A DPIA is not a bureaucratic formality. It is the mechanism by which an organisation identifies what personal data it will process, why, on what legal basis, how it will be secured, how long it will be retained, and who it will be shared with. Skipping it means none of those questions were answered before the data went in.

This is shadow IT in a law enforcement context. Officers adopted a tool without going through the governance process that exists precisely to prevent this outcome. The ICO's reprimand is a formal finding of failure, not a monetary penalty, but it carries weight: the regulator has put on record that the Met processed personal data without the safeguards the law requires.

The affected individuals — 179 of them, three of them minors — have no clear assurance about how their information was safeguarded, shared or retained. That is the practical consequence of the governance gap.

The reprimand also raises a wider question. If a force the size of the Met can accumulate hundreds of unapproved accounts on a third-party platform over an 18-month period, how many other public bodies have similar arrangements that nobody has assessed?

Those gaps matter, but they do not change the core finding: the assessment should have happened first.