ICO reprimands Met Police over unapproved Auror uploads

The ICO reprimanded the Metropolitan Police for uploading personal data on 179 people to Auror without required checks.

The UK Information Commissioner’s Office reprimanded London’s Metropolitan Police and issued an enforcement notice after officers used the Auror retail-crime platform without procurement approval or required data-protection checks. From March 2023 to September 2024, officers registered about 500 free accounts; Infosecurity Magazine says 375 of those were active. Sources disagree on the uploads: The Register says data on 179 people, including three children, consisted of names for 128, names and dates of birth for 49, and names, dates of birth and addresses for two, while Infosecurity Magazine says names, dates of birth and home addresses for all 179, including three under 18, were uploaded from January to September 2024. Both report that no DPIA was completed first; The Register also says there was no data-sharing agreement, and Infosecurity cites a missing consent basis, weak safeguards and continued gaps in approving third-party technology. Access was blocked on 26 September 2024, and the Met says checks were later completed so Auror is again used in 14 London boroughs. The ICO also pointed to the force’s 2021 Clearview AI use as a repeat failure.

• The UK ICO reprimanded the Metropolitan Police and issued an enforcement notice over use of the Auror retail-crime platform.
• From March 2023 to September 2024, officers used about 500 free Auror accounts without formal approval; Infosecurity Magazine says 375 were active.
• Personal data on 179 people, including three children, was uploaded. Sources disagree on fields and timing: The Register reports names for 128, names and dates of birth for 49, and names, dates of birth and addresses for two; Infosecurity…
• No DPIA was completed beforehand. The Register also says no data-sharing agreement was in place; Infosecurity cites a missing consent basis, weak safeguards and ongoing gaps in third-party technology approval.
• Access was blocked on 26 September 2024. The Met says checks were later completed and Auror is again used in 14 London boroughs.
• The ICO cited the force’s 2021 Clearview AI use as a repeat failure.