Met Police Faces Sanctions After Unlawful Upload of 179 People's Data to Retail Platform

The short version

• Personal data belonging to 179 people was unlawfully uploaded to Auror by Metropolitan Police officers between March 2023 and September 2024.
• The data included names for 128 individuals, while 49 had dates of birth added and two had home addresses included in the records.
• The force had not procured the service formally or established data-sharing agreements with Auror Europe before officers created approximately 500 accounts.

The details

The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) after finding that officers used a retail crime platform without corporate approval or necessary data protection checks, according to The Register. The watchdog issued an enforcement notice following a probe that began in April 2025. Officers registered around 500 free accounts on Auror between March 2023 and September 2024. The force had not completed a data protection impact assessment (DPIA) or signed agreements with Auror Europe, a subsidiary of New Zealand-based Auror registered in England and Wales.

The ICO determined that personal data relating to 179 people, including three children, was unlawfully uploaded. For 128 of these individuals, only names were recorded. For 49 people, names and dates of birth were added. In two cases, officers uploaded names, dates of birth, and home addresses. Retailers such as supermarkets encouraged officers to use the platform and directed them to it to access CCTV footage. The platform allows retailers to share incident reports, images, and video, with police partners accessing it free of charge while retailers pay for browser or mobile app access.

Internal security concerns emerged between August and September 2024. Two separate reports were filed regarding the use of Auror. The first related to officers uploading names of suspects identified from CCTV footage. The second pertained to officers collecting CCTV footage from the platform despite no checks being made on the data. Access to Auror was blocked for MPS users on 26 September 2024. The MPS data protection officer informed the ICO of the force's use of Auror in December 2024 during discussions about a separate matter.

The context

The incident highlights the risks of unvetted third-party tools in law enforcement operations. Officers were directed to Auror by retailers seeking to record crimes such as shoplifting. The platform facilitates the sharing of sensitive material, including images and video, between commercial entities and police partners. The lack of formal procurement and data-sharing agreements meant that the flow of personal data from police officers to a commercial platform occurred without established legal safeguards or oversight mechanisms.

The ICO's investigation followed the disclosure by the MPS data protection officer. The formal probe launched in April 2025 resulted in the reprimand and enforcement notice. The findings confirm that the force failed to complete required privacy checks before allowing widespread use of the service. The blocking of access in September 2024 followed internal reports that raised alarms about the handling of suspect data and footage.

Defender's checklist

• Ensure all third-party platforms used for data collection undergo formal procurement and privacy impact assessments before deployment.
• Establish clear data-sharing agreements with any external service provider that handles personal or sensitive information.
• Monitor internal security reports and act immediately on concerns regarding unvetted data handling or unauthorized tool usage.
• Block access to unapproved platforms once risks are identified to prevent further unauthorized data uploads or collection.

If your data is involved

If you suspect your details were uploaded to an unvetted platform, review your credit reports for unexpected changes or new accounts. Monitor bank statements for unrecognised transactions that could indicate identity misuse. Be wary of unsolicited communications claiming to be from police or support teams, as fraudsters often exploit data breaches to launch phishing campaigns. Verify the identity of any caller by hanging up and contacting the organisation directly using official contact details found on their website.

Background: Data protection officers

You do not need a full-time hire to handle data protection. Map your data flows, assign accountability to existing staff, and use clear policies to manage risk. Delegate technical controls to IT providers while retaining legal oversight. This approach keeps costs low and compliance high.

Read the full guide: Data Protection Officers for Small Businesses: Practical Steps

What to do and how to stay safe

• Check your credit file with major credit reference agencies to ensure no new accounts or searches have appeared without your knowledge.
• Review recent bank and credit card statements for small, unauthorised transactions that could signal testing of your payment details.
• Enable multi-factor authentication on all sensitive online accounts, particularly banking and email, to add a layer of security against credential theft.
• Report any suspicious emails or phone calls claiming to be from the police or data protection agencies to the relevant fraud reporting centre.

Step-by-step guide: What is online tracking: how data follows you and how to stop it

General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many people had their data unlawfully uploaded to Auror?

The ICO found that personal data relating to 179 people, including three children, was unlawfully uploaded to the platform.