THE Information Commissioner’s Office (ICO) has issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) over governance failings linked to its use of the Auror third‑party platform for crime intelligence and shoplifting operations. The ICO’s investigation found that from March 2023 to September 2024, MPS officers and staff used Auror despite it not being formally approved, with around 500 MPS accounts created and 375 active.
Auror is described as providing high‑level incident summaries, case management, data visualisation and reporting, including a “Connect the Dots” module that uses image matching and manual suggestions to link events and individuals.
Between January and September 2024, personal information including names, dates of birth and home addresses relating to 179 people (three of whom were under 18) were uploaded to the unvetted platform. The ICO notes two internal security incident reports from the time: one involving an officer uploading the full names of suspects from CCTV images, and another where officers were flagged for using Auror to collect CCTV images from retailers without approval from the MPS cybersecurity team.
The regulator identified four infringements, including unlawful processing without consent or necessity for law enforcement purposes; failure to implement appropriate technical and organisational measures and proper assessment and approval processes for third‑party technologies; failure to complete a data protection impact assessment (DPIA) before high‑risk processing; and ongoing failure to ensure only approved third‑party technologies process personal information. David Doodson, ICO head of investigations, urged robust safeguards and governance when deploying new systems.