The Metropolitan Police Service has been reprimanded after police officers and staff uploaded sensitive personal data about suspects to an unapproved web platform used by retailers to track shoplifters.
The Information Commission’s Office warned that the incident reflected an “ongoing failure” by the police service to install technical restrictions to prevent staff using unauthorised services, or shadow IT, for police work.
The ICO found that measures put in place by the Metropolitan Police to prevent staff using an unauthorised facial recognition application Clearview, four years earlier had failed to prevent a similar incident occurring.
The data protection watchdog said in a reprimand issued on 15 October that police officers and staff had put individuals at risk by posting details about people suspected of shoplifting on a web platform used by retailers to deter shoplifting.
The Auror platform, which is owned by a New Zealand-based company, allows retailers to record and analyse shoplifting incidents using facial recognition, automatic number plate recognition and artificial intelligence.
Retailers can upload incident reports, images and CCTV footage which they can share with police officers. Police officers, who are given free accounts on the platform, can also share information with retailers about suspects.
Police use of Auror was ‘high risk’
An investigation by the ICO found that the platform, which is used by retailers including Tesco, Boots, M&S, Greggs, Holland and Barrett and Home Bargains, was being used by MPS officers and staff without the knowledge of the police force and without having adequate security in place to protect sensitive data.
The MPS claims to have alerted the ICO as soon as it became aware of the problem in September 2024, but the ICO reported that it had only learned of the incident during a discussion about a separate matter in December 2024.
The use of an unapproved platform to identify potential criminal offenders was likely to result in a “high risk” to the people affected, including misidentification as an offender, being banned from premises, having their movements restricted or damage to their reputation, the ICO found.
According to the Metropolitan Police Service, retailers encouraged police officers to sign up to the Auror platform to review CCTV evidence of reported crimes from early 2023.
The police officers were sent QR codes by Auror Europe, which used MPS branding on its website, to allow them to create their own free accounts on the service.
A subsequent investigation revealed that Police Officers and staff created 500 accounts, of which 375 were actively used. The MPS said it did not have information on how frequently officers had accessed the platform.
Police staff identified 179 unique individuals, of which 59 were arrested, charged or convicted or had their information circulated as a wanted person after being identified on the Auror platform.
An internal review found that police officers and staff had shared sensitive personal information, including the names of suspects, dates of birth, addresses and in some cases references to use of facial recognition software. It also included information about three people under the age of 18.
The names, warrant numbers and email addresses of MPS officers were also shared on the Auror platform.
Missed opportunities to identify problem
The ICO’s investigation revealed the police service missed multiple opportunities to restrict the use of the platform, which had been used by MPS staff since March 2023, before finally taking action
In June that year, for example, a police officer, who no longer works for the force, submitted a request to have access to a mobile version of the platform, Auror Frontline, which was approved in principle by a committee 18 days later, without raising any alerts.
In August 2024, the MPS had another opportunity to shut the system down, when a security incident report found that a member of staff had uploaded the names of suspects they recognised in CCTV images shared by a retailer to Auror.
The police force took action to restrict the platform after a second incident report a month later that found officers were using the Auror platform to collect CCTV images from retail outlets during investigations.
Ongoing failures
The ICO said that the failings form part of a broader and ongoing failure to ensure that the processing of data by MPS officers and staff on third party systems is carried out securely.
There was an “ongoing failure” to implement further technical restrictions to prevent staff using unauthorised services.
“The MPS failed, and continues to fail, to implement appropriate technical and organisational measures to ensure that the processing of personal data by its officers and staff using third party online services…is subject to appropriate levels of assessment, approval and organisational oversight,” the ICO stated.
The ICO also found that the MPS had failed to demonstrate that it had taken appropriate steps to ensure all officers and staff had read and understood its data protection policies and had received regular training.
Met Police now using Auror
The MPS signed a formal contract with Auror Europe in December 2025 and began using the system operationally to fight shoplifting in January this year.
Police officers are now restricted from uploading and sharing data on the platform and must access the platform through a secure authentication system.
The MPS announced in August 2026 that it had completed a pilot of Auror in six London boroughs and would roll it out in another eight boroughs, after seeing improvements in the clear-up rate for shoplifting offences.
“Following formal approval and a pilot, the platform is now used in 14 London boroughs. It helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting,” a spokesperson said.
Lessons not learned from Clearview
The ICO found that many of the failings with Auror echoed those identified several years earlier in 2021, when the ICO reprimanded the MPS over staff’s use of an unauthorised facial recognition platform, Clearview AI, to investigate criminal offences.
Although the MPS had introduced a range of improvements and safeguards before reintroducing Auror in January 2026, the ICO said the police force needed to improve how it identifies and assesses third-party services used to process personal information.
“The MPS has failed to demonstrate that its current technical and organisational measures are appropriate to ensure an appropriate level of security for the personal data it processes,” the ICO stated.
David Doodson, ICO Head of Investigations, said that police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.
“Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight,” he added.
An MPS spokesperson said that it accepted the ICO’s findings that data protection arrangements at the time were insufficient.
“While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used,” the spokesperson added.
