Met Police Hit With Enforcement Notice After Minors' Data Uploaded to Unvetted Third-Party Tool
The ICO penalized the Metropolitan Police for using an unvetted third-party tool, highlighting risks of unauthorized data processing and weak supplier controls.
Key points
- The Information Commissioner’s Office issued a reprimand and enforcement notice to the Metropolitan Police Service.
- Officers used the Auror platform without formal approval, uploading personal data for 179 individuals, including minors.
- The regulator cited failures in data protection impact assessments and technical safeguards for third-party tools.
The UK Information Commissioner’s Office has sanctioned the Metropolitan Police Service for governance failures involving a third-party crime intelligence platform. According to Infosecurity Magazine, the regulator issued both a reprimand and an enforcement notice. This action targets the unauthorized use of the Auror system, which was intended for shoplifting crackdowns but operated without the necessary formal approvals from the force’s leadership or security teams.
The risk
The core issue involves the processing of sensitive personal information without proper consent or legal necessity. Between January and September 2024, data including names, dates of birth, and home addresses for 179 people was uploaded to the unvetted platform. Three of these individuals were under the age of 18. The platform features image matching and data visualization tools, which increased the sensitivity of the exposure.
Who is exposed
The investigation revealed that approximately 500 accounts were created for Metropolitan Police staff, with 375 remaining active. Internal security incident reports flagged the misuse early on. In one instance, an officer uploaded suspect names recognized from retailer CCTV images. In another, officers were caught collecting CCTV footage from retailers despite the platform lacking approval from the MPS cybersecurity team.
Cost and compliance
The ICO identified four specific infringements regarding data protection laws. The force unlawfully processed personal information and failed to implement appropriate technical and organizational measures. It also neglected to conduct a data protection impact assessment before undertaking high-risk processing. Furthermore, the regulator noted a continuing failure to ensure that only approved third-party technologies are used to handle personal data.
What happens next
Managers must review all third-party integrations currently in use within their organization. Verify that every tool handling personal data has completed a formal risk assessment and received explicit approval. Ensure that technical safeguards are in place to prevent unauthorized uploads or access to sensitive information by staff who have not been vetted for such responsibilities.
Questions to ask your suppliers
Teams usually need to verify whether a vendor’s tool has undergone independent security audits and data protection impact assessments before deployment. Ask your procurement and legal departments to confirm that contracts explicitly define data ownership, processing limits, and breach notification timelines. Check whether the supplier provides technical controls that prevent unauthorized data entry or sharing. Ensure that internal teams are trained to recognize approved workflows versus shadow IT practices that bypass security gates.
What to do and how to stay safe: Auror
- Audit all third-party software currently in use to identify any tools that lack formal security approvals or data protection assessments.
- Implement strict access controls and technical barriers to prevent employees from uploading sensitive personal data to unauthorized platforms.
- Establish a clear process for reporting and investigating internal security incidents related to data handling and software usage.
- Review vendor contracts to ensure they include clauses for regular security audits and immediate notification of any data breaches.
Step-by-step guide: Data Breach Myths: Why Common Security Beliefs Fail
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was exposed in this incident?
Personal information including names, dates of birth, and home addresses for 179 individuals, three of whom were minors, was uploaded to the platform.
Why was the Metropolitan Police sanctioned?
The ICO cited unlawful processing of data, failure to implement technical safeguards, and lack of data protection impact assessments for high-risk processing.
Was the Auror platform approved for use?
No, the platform was not formally approved by the Metropolitan Police Service, despite officers creating hundreds of accounts and using it for crime intelligence.
