Met staff used an unapproved Auror platform for about 18 months, ICO finds
ICO reprimanded the Metropolitan Police for putting data on 179 people into Auror, a platform that had no data protection impact assessment. The force has tightened procedures since, but the regulator says it still is not ensuring that only approved tools are used.
The Board Room · Leadership desk
A bar shows that 375 of around 500 Auror accounts created were actively used for policing activities, according to the ICO.
- Actively used for policing, claim 3 375 of 500 of around 500 accounts 75% computed
Actively used for policing The rest of the 500
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Actively used for policing | 375 of around 500 accounts | 500 of around 500 accounts | 75% (computed) | 3 |
What happened
- Auror lets retailers upload incident reports, images and CCTV footage of suspected shoplifting and share them with law enforcement for free.
- About 500 accounts were created on the platform, and 375 of them were actively used for policing activities.
- Names and dates of birth were uploaded, and in a small number of cases home addresses.
- The ICO said the Met unlawfully processed personal information without individuals' consent and where sharing was not necessary for law enforcement purposes.
- Remedies ordered by the ICO cover identifying, assessing and approving third-party services, plus control reviews, governance, staff awareness and regular testing.
Why it matters
- Who's exposed exposure Free tools reach staff without a budget line, so a data protection check tied to purchasing would not catch them.
- What it sets up precedent The ICO framed the Met action as a message to policing and beyond, so other sectors can expect the same test of lawful, governed use from the outset.
- Who has to decide decision Whether to inventory outside tools now is the open choice: two-thirds of organizations in SailPoint's survey could not account for what staff share with AI platforms.
Next story · Security · yesterday
Legal Aid Agency traces records stolen in April 2025 breach back to 1978Confirmed4 publishers
The platform's defenders have a plain argument, and IT Pro states it: the tool "may seem not only harmless but actively helpful in the detection and prosecution of crime" [14]. David Doodson, the ICO's head of investigations, gave the regulator's reply: "organizations cannot allow innovation to outpace their data protection responsibilities" [10]. The trade-off is speed of adoption against the time a review takes. The Met's use ran for about 18 months [18] without formal approval [1], and IT Pro reports the tool was not put through the usual data protection assessments or governance first [11].
Use was broad. Three of every four accounts created were in active use [19]. The count of people has a window, though: the ICO's figure of 179 covers January to September 2024 [4], which opens ten months after use began in March 2023 [20]. Three of those people were under 18 [4]. IT Pro's report does not say what was uploaded before January 2024 or whether a penalty accompanied the reprimand.
The ICO's order to the Met starts with identifying, assessing and approving third-party services [9]. That order follows the failure the ICO named: the force did not put measures in place to make sure assessment and approval processes were followed [6]. In our view, the accounts and uploads the ICO counted all came downstream of that gap, which makes the moment before accounts exist the cheapest point to check. Each account created afterwards is a separate thing to find and close.
The same logic sets the sequence for a leader. An inventory of outside tools is this quarter's decision. The regular testing the ICO ordered [9] is next quarter's consequence, because a list of approved tools holds only if checks show staff are using nothing else. The Met's own experience supports that order: it tightened procedures after the issue emerged, and the ICO still said it needs to do more [8].
The wider evidence IT Pro cites is a SailPoint survey about AI tools, not about Auror. In it, 35% of staff share data through external tools instead of approved internal applications [16].
What to watch
- Any ICO follow-up on whether the Met's revised controls now keep unapproved third-party tools away from personal information.
- Whether the ICO issues comparable findings against other police forces or against organizations outside policing.
- Any disclosure of what was uploaded to Auror before January 2024, which would change the count of affected people.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence82
- Adoption60
- Hype gap−10
- Incentives
- Not scored
- Confidence78
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Between March 2023 and September 2024, officers and staff in the Metropolitan Police used the Auror intelligence-sharing platform as part of a crackdown on shoplifting, although it was not formally approved for use.
- [2]
The ICO said the Met unlawfully processed personal information without individuals' consent and in situations where sharing was not actually necessary for law enforcement purposes.
- [3]
Around 500 Auror accounts were created, with 375 actively used for policing activities.
- [4]
The ICO found that, between January and September 2024, personal information relating to 179 people, three of whom were under 18, was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting.
- [5]
The uploaded personal information included names, dates of birth and, in a small number of cases, home addresses.
- [6]
The Met failed to put appropriate technical and organizational measures in place to make sure that personal information was protected or that assessment and approval processes for third-party technologies were followed.
- [7]
The ICO found that the Met did not carry out a data protection impact assessment and still is not ensuring that only approved third-party technologies are used to process personal information.
- [8]
Since the issue first emerged, the Met has tightened up its procedures, but the ICO said it still needs to do more.
- [9]
The ICO ordered the force to strengthen its approach to identifying, assessing and approving any third-party services used to process personal information, and to review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of its measures.
- [10]
David Doodson, ICO head of investigations, said: 'Whilst new technologies can deliver significant operational benefits, organizations cannot allow innovation to outpace their data protection responsibilities.'
- [11]
The Auror tool was not subjected to the usual data protection assessments or governance before use.
- [12]
Doodson said: 'This action should send a message across the policing sector, and beyond: if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset.'
- [13]
Retailers can upload incident reports, images and CCTV footage relating to suspected shoplifting and other retail-related offences to Auror, which can then be shared for free with law enforcement authorities.
- [14]
IT Pro wrote that the tool 'may seem not only harmless but actively helpful in the detection and prosecution of crime'.
- [15]
A SailPoint survey earlier this year found that two-thirds of organizations cannot account for the information staff are sharing with AI platforms and large language models.
- [16]
The SailPoint survey also found that 35% of staff are sharing data through external tools rather than approved internal applications.
- [17]
IT Pro reported that the ICO reprimanded the Metropolitan Police over its use of shadow IT.
- [18]
Use of Auror ran for about 18 months.
- [19]
Active accounts were 75% of the accounts created.
- [20]
The ICO's January 2024 count window opens ten months after use began in March 2023.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comICO Reprimands Met Over Third-Party Data Leak
1 article · October 15, 2026
- itpro.comICO reprimands Metropolitan Police over use of shadow IT
1 article · October 16, 2026
Topics and entities
Topics
- Police technology
- Data Protection Enforcement
- Shadow IT
Entities
- SailPoint
- Metropolitan Police Service
- Information Commissioner's Office