The UK's Information Commissioner's Office has formally reprimanded the Metropolitan Police Service and issued an enforcement notice over officers' use of Auror, a retail crime reporting platform. Between March 2023 and September 2024, around 500 free accounts were registered by officers without the force formally procuring the service or completing a data protection impact assessment.
The ICO found that personal data relating to 179 people, including three children, was unlawfully uploaded to Auror. For most, this was names alone; for others, it included dates of birth and, in two cases, home addresses. The regulator also criticised the force's reliance on soft controls such as policy reminders, noting that officers used the platform for more than 18 months without triggering any web-control alerts. It drew parallels to a previous incident involving Clearview AI in 2021.
The Met Police accepted the findings, saying officers had acted in good faith but acknowledging that the relevant security and data protection work had not been completed. Access to Auror was suspended in September 2024, and after a full review and pilot, the platform is now formally approved and used in 14 London boroughs. The force says the platform has quadrupled positive outcomes for shoplifting cases reported through it.