# Metropolitan Police Reprimanded Over Unapproved Use of Shoplifting Platform ICO issues enforcement notice after police used retail crime software without data protection checks. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-15 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/6bf917df-cf25-4c76-a4d8-aee99d758ac7 ## Unauthorized Platform Usage Between March 2023 and September 2024, Metropolitan Police officers registered 500 accounts on the retail crime platform Auror without formal procurement or data protection assessments. Retailers encouraged this usage to facilitate CCTV footage sharing. The force failed to conduct a Data Protection Impact Assessment or establish necessary data-sharing agreements before utilizing the service. ## Data Privacy Violations The ICO investigation revealed that officers unlawfully uploaded personal data of 179 individuals, including three children, to the Auror platform. This data included names, dates of birth, and home addresses. These actions occurred without any oversight, as officers bypassed internal security protocols while attempting to identify shoplifting suspects from shared CCTV footage. ## Systemic Oversight Failures The ICO identified that the Metropolitan Police relied on ineffective soft controls, such as policy reminders, rather than robust technical blocks. The force failed to test its web controls, allowing officers to use the unapproved platform for over 18 months without triggering alerts. This represents a recurring issue following previous incidents involving Clearview AI. ## Regulatory Enforcement Action Following a formal probe launched in April 2025, the ICO issued an enforcement notice requiring the force to strengthen safeguards against improper third-party tool usage. The Metropolitan Police must now provide periodic progress updates to the regulator. This action serves as a warning to the broader policing sector regarding lawful information processing. ## Operational Impact and Recovery After suspending access in September 2024, the force conducted a full review and completed necessary legal and security checks. The platform is now officially approved and deployed across 14 London boroughs. The Metropolitan Police reports that this technology has quadrupled positive outcomes for shoplifting cases, with a 29.4 percent resolution rate. ## Broader Data Governance Issues This reprimand follows other significant data protection failures by the Metropolitan Police. In August, the force faced criticism for exposing a victim's address through unredacted legal documents and leaking email addresses of 18 individuals via an improper email blast. These incidents highlight persistent challenges in managing sensitive information within the organization's current operational framework. ## Technological Integration Challenges The case underscores the tension between adopting new investigative technologies and maintaining strict data governance. While tools like Auror improve efficiency in identifying shoplifters, their integration requires rigorous vetting. The Metropolitan Police now emphasizes that all future deployments of third-party software will undergo comprehensive commercial, legal, and security evaluations before implementation. ## Future Compliance Expectations The ICO maintains that the Metropolitan Police's failures are ongoing until the force demonstrates that its safeguards can effectively prevent similar unauthorized incidents. The regulator's intervention aims to drive higher standards across the sector, ensuring that public bodies prioritize transparency and accountability when utilizing new digital tools to process sensitive citizen information. ## Sources covering this story - https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._