ICO Reprimands Met Over Third-Party Data Leak
UK ICO reprimands the Metropolitan Police after personal data on 179 people reached unapproved Auror.
The UK Information Commissioner's Office reprimanded the Metropolitan Police Service and issued an enforcement notice over its use of the Auror retail-crime platform. Between March 2023 and September 2024, officers used Auror without formal approval; about 500 accounts were created and 375 were active. From January to September 2024, names, dates of birth, and home addresses for 179 people, including three children, were uploaded. The ICO found unlawful processing, weak safeguards, no prior DPIA, and continued gaps in approving third-party technology.
- ICO issued a reprimand and enforcement notice to the Metropolitan Police.
- Officers used unapproved Auror from March 2023 to September 2024.
- Personal data on 179 people, including three under 18, was uploaded.
- ICO cited missing consent basis, safeguards, DPIA, and ongoing third-party controls.
Full article433 words · extracted from infosecurity-magazine.com · click to collapse
The UK’s data protection regulator has issued a reprimand and enforcement notice to the capital’s police force after a string of governance failings related to its use of a third-party platform.
The investigation by the Information Commissioner’s Office (ICO) was focused on Metropolitan Police Service (MPS) use of the Auror retail crime intelligence-sharing platform, which it used in a crackdown on shoplifting.
The watchdog found that, between March 2023 and September 2024, MPS officers and staff used the platform despite it not being formally approved. Some 500 MPS accounts were created, of which 375 were active, it said in its writeup of the case.
Auror provides high-level summaries of incidents, case management, data visualisation and reporting, and a “Connect the Dots” module, which uses image matching and manual suggestions to identify links between events and individuals. It has been lauded as quadrupling the number of shoplifters brought to justice in London.
However, the ICO said that between January and September 2024 personal information including names, dates of birth and home addresses relating to 179 people – three of whom were under 18 – was uploaded to the unvetted platform.
Read more on MPS privacy woes: ICO Reprimands Metropolitan Police for Data Snafu
Two “security incident reports” were raised internally at the time. In the first, an officer uploaded the full names of suspects they recognized in CCTV images shared by a retailer. In the second, officers were flagged as using the platform to collect CCTV images from retailers despite Auror not having been approved by the MPS cybersecurity team.
The ICO found four infringements. It said the MPS:
- Unlawfully processed personal information without the individual’s consent and where sharing wasn’t necessary for law enforcement purposes
- Failed to implement “appropriate technical and organizational measures” to protect personal information and follow proper assessment and approval processes for third-party technologies
- Failed to complete a data protection impact assessment (DPIA) before undertaking high-risk processing
- Continues to fail to implement appropriate measures to ensure only approved third-party technologies are used to process personal information
David Doodson, ICO head of investigations, said police forces must have robust safeguards in place to protect the large volumes of sensitive personal information they handle.
“Organizations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight,” he added.
“This action should send a message across the policing sector, and beyond: if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset.”