What happened
The Information Commissioner's Office issued a reprimand and an enforcement notice to the Metropolitan Police Service after investigating how the force used Auror, a retail crime intelligence sharing platform, during a shoplifting crackdown. Between March 2023 and September 2024, the ICO found, officers and staff used the platform even though it had never been formally approved. Around 500 MPS accounts were created, of which 375 were active.
Auror provides high level summaries of incidents, case management, data visualisation and reporting, along with a "Connect the Dots" module that uses image matching and manual suggestions to identify links between events and individuals. The ICO said that between January and September 2024, personal information including names, dates of birth and home addresses relating to 179 people, three of them under 18, was uploaded to the unvetted platform.
Two internal security incident reports were raised at the time. In the first, an officer uploaded the full names of suspects they recognised in CCTV images shared by a retailer. In the second, officers were flagged as using the platform to collect CCTV images from retailers despite Auror not having been approved by the MPS cybersecurity team.
The ICO found four infringements. It said the MPS unlawfully processed personal information without consent and where sharing was not necessary for law enforcement purposes; failed to implement appropriate technical and organisational measures, including proper assessment and approval processes for third party technologies; failed to complete a data protection impact assessment before high risk processing; and continues to fail to ensure that only approved third party technologies are used to process personal information. David Doodson, the ICO's head of investigations, said organisations "cannot allow innovation to outpace their data protection responsibilities."
Why this is a GRC story
The approval workflow was the control, and it was bypassed. A platform used across hundreds of accounts never went through sign off, and the cybersecurity team's own objection did not stop its use. The policy existed on paper; the mechanism for enforcing it did not.
Incident reports without escalation are noise. Two internal reports flagged precisely the behaviour the regulator later penalised. The failure was not detection. It was ownership, escalation and closure.
No DPIA before high risk processing. Image matching across police and retailer data is exactly the kind of processing that needs a documented assessment up front rather than a reconstruction afterwards.
An enforcement notice looks forward. A reprimand plus a notice is an ongoing obligation with a deadline, not a lesson learned memo filed away.
What to watch
Watch how other police forces respond, and how far the message travels beyond policing, because the same pattern appears anywhere staff can sign up for a SaaS tool in minutes. The practical test for any third party risk program is whether you can list every tool touching personal data, name the approver, and produce the assessment. Most organisations fail that test at least once. Failing it because a regulator asked is the expensive version.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.