# Metropolitan Police Reprimanded Over Unapproved Use of Shoplifting Data Platform ICO mandates stricter data safeguards after police accessed retail crime software without proper vetting. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-15 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/2679e20f-965d-4517-b729-601da555eac6 ## Unauthorized Retail Platform Usage The Metropolitan Police Service faced an ICO enforcement notice after officers utilized the Auror retail crime platform without formal procurement or data protection checks. Between March 2023 and September 2024, officers registered 500 accounts on the site. This occurred despite the lack of a mandatory data protection impact assessment or formal sharing agreements. ## Unlawful Personal Data Processing The investigation revealed that officers uploaded personal data of 179 individuals, including three children, to the platform without legal authorization. This data included names, dates of birth, and home addresses. The ICO highlighted that these actions occurred while officers were attempting to identify shoplifters, yet they bypassed essential institutional security and privacy protocols. ## Systemic Oversight and Control Failures The ICO criticized the force for relying on soft controls like policy reminders rather than technical blocks to prevent unauthorized software use. The regulator noted that officers operated on the platform for 18 months without triggering internal alerts. This failure to test web controls allowed persistent, unmonitored access to sensitive third-party digital tools. ## Historical Context of Non-Compliance This incident marks a repeat failure for the Metropolitan Police, following their unauthorized use of Clearview AI in 2021. The regulator emphasized that the force has not yet demonstrated that its current safeguards can effectively prevent similar future incidents. Consequently, the ICO views these data protection failures as ongoing and requiring immediate, rigorous intervention. ## Operational Impact and Enforcement The enforcement action compels the Metropolitan Police to strengthen its third-party tool safeguards and provide the ICO with periodic progress updates. While access was temporarily blocked in September 2024, the force has since completed necessary legal and security checks. They now utilize the platform in 14 London boroughs under a formal, approved pilot scheme. ## Positive Outcomes Versus Privacy Risks The Metropolitan Police reports that using the platform has quadrupled positive outcomes for shoplifting cases. As of August 2026, the force plans to expand the technology beyond the initial 14 boroughs, citing a 29.4 percent positive outcome rate. They maintain that the tool helps identify suspects more quickly by facilitating direct evidence sharing from retailers. ## Broader Pattern of Data Mishaps This reprimand follows other recent data protection rebukes for the Metropolitan Police, including the accidental exposure of a victim's address in a stalking case. Another incident involved an officer exposing email addresses of 18 individuals linked to Parliament. These recurring errors highlight significant challenges in maintaining data integrity across various police operational departments. ## Regulatory Standards for Policing The ICO’s David Doodson stated that this action serves as a warning to the entire policing sector regarding new technology adoption. Organizations must ensure lawful, transparent, and governed data processing from the outset. The regulator aims to drive higher standards, emphasizing that public trust depends on the secure handling of sensitive personal information. ## Sources covering this story - https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._