Full Breakdown
Information Commissioner's Office (ICO) Reprimand Over Metropolitan Police’s Unapproved Use of Retail Crime Platform Auror
By Drooid · · How we work
Background and Use of Auror
Between March 2023 and September 2024, officers of London’s Metropolitan Police Service (MPS) created roughly 500 free accounts on Auror, a retail-crime platform that enables supermarkets and other stores to share incident reports, images and CCTV footage. Auror Europe, a subsidiary of New Zealand-based Auror, provides the service to retailers at cost, while police partners use it without charge. Retailers such as Tesco, Boots, Greggs and M&S directed officers to the platform to obtain footage, but the force never formally procured the service, completed a data-protection impact assessment (DPIA), or established data-sharing agreements.
Data-Protection Breaches Identified
The Information Commissioner’s Office (ICO) found that officers uploaded personal data on 179 individuals—including three children—without lawful authority. For 128 people only names were uploaded; for 49, names and dates of birth; and for two, names, dates of birth and home addresses. The ICO noted that the MPS relied on “soft controls” such as policy reminders rather than technical blocks, allowing the breach to continue for more than 18 months. Access to Auror was blocked as of September 26, 2024. The regulator described the failure as a repeat of earlier misuse of Clearview AI in 2021.
Official Responses
The ICO issued an enforcement notice compelling the MPS to strengthen safeguards for third-party tools and to provide periodic progress updates. David Doodson, head of investigations at the ICO, said the action is intended to ensure lawful, transparent processing of personal information.
The MPS acknowledged the ICO’s findings, stating that its data-protection arrangements were insufficient at the time of the breach.
Verbatim Quotes
- “This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset.” — David Doodson
- “Of the ICO's findings, the spokesperson said: "We accept the ICO's findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.” — the spokesperson
These statements underscore the regulator’s demand for robust governance of police-technology use and the Met’s acceptance of past shortcomings while promoting the perceived benefits of the Auror system.