Thursday 15 October 2026
Evening Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Met Police reprimanded over unlawful use of retail crime platform Auror

Watchdog finds officers uploaded personal data of 179 people, including three children, without approval or data protection checks

By LineZotpaper
Published
Read Time3 min
The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service and issued an enforcement notice after officers used the retail crime platform Auror for more than 18 months without formal approval or the required data protection checks, unlawfully processing personal data of 179 people.

Between March 2023 and September 2024, Met officers registered around 500 free accounts on Auror, a platform supermarkets and other retailers use to record crimes such as shoplifting and share incident reports, images and CCTV footage. Retailers encouraged officers to use the service and directed them to the platform to access CCTV. Auror Europe, registered in England and Wales, is a subsidiary of New Zealand-based Auror; retailers pay for access while police partners use it free of charge.

The ICO found the force never formally procured the service, completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe. Officers unlawfully uploaded personal data relating to 179 people, including three children: for 128 people this was names alone, for 49 names and dates of birth, and for two names, dates of birth and home addresses.

Two internal security reports were filed between August and September 2024, one relating to officers uploading names of suspects they recognised from CCTV footage, the other to officers collecting CCTV footage despite no checks being made on it. Access to Auror was blocked on September 26, 2024. The force's data protection officer informed the ICO of the Auror use in December 2024 during a discussion about a separate matter, prompting a formal probe in April 2025.

The regulator said the MPS failed to ensure adequate oversight of what third-party platforms officers were allowed to use, a failure it considers ongoing. It criticised the force's reliance on "soft controls" such as policy reminders and staff training rather than technical blocks, noting officers used Auror for more than 18 months without triggering a web-control alert. The ICO described the case as a repeat failure, pointing to officers' use of Clearview AI in 2021 without proper oversight.

The enforcement action compels the MPS to strengthen safeguards against improper use of third-party tools and provide the ICO with periodic progress updates. David Doodson, the ICO's head of investigations, said the action should send a message across the policing sector that new technology processing people's information must be used lawfully, transparently and with appropriate governance from the outset.

The Met told The Register that, following stricter controls and a pilot scheme, officers in 14 London boroughs are once again using Auror. A spokesperson said the platform helps officers identify shoplifters more quickly, enabling retailers to share evidence and CCTV at the point of reporting, and has quadrupled positive outcomes for shoplifting. In an August 2026 announcement the force said the technology would be rolled out beyond the 14 boroughs.

§

Analysis

Why This Matters

  • The case tests whether police forces can deliver operational benefits from private crime platforms without breaching data protection law.
  • It involves the personal data of 179 people, including children, processed without a lawful basis or impact assessment.
  • The ICO frames it as a repeat failure, following the force's use of Clearview AI in 2021, raising questions about whether oversight lessons are being learnt.

Background

UK data protection law requires organisations to carry out data protection impact assessments and establish lawful grounds and data-sharing agreements before processing personal data, including through third-party platforms. Policing is an area where such processing is often justified on public-interest grounds, but the regulator expects it to be formally approved and documented. The Met's unapproved use of Auror echoes its earlier use of facial recognition firm Clearview AI, which also drew regulatory criticism for a lack of proper oversight.

Key Perspectives

The ICO: Holds that any use of new technology to process people's information must be lawful, transparent and governed from the outset, and says its role is to hold organisations to account and drive improvements. The Metropolitan Police: Argues the platform delivers clear operational value, enabling retailers to share evidence and CCTV directly at the point of reporting and quadrupling positive outcomes for shoplifting. It says stricter controls and a pilot preceded the current use across 14 boroughs. Retailers and Auror: Retailers actively directed officers to the platform to access CCTV, and Auror provides the service to police free while retailers pay, a model the platform says supports faster identification of shoplifters.

What to Watch

  • Whether the rollout of the platform beyond the 14 boroughs proceeds and how quickly.
  • Whether the MPS can demonstrate to the ICO that technical safeguards now prevent unapproved platform use.
  • The ICO's required periodic progress updates, and whether any further enforcement follows if the force is judged to have failed again.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe