The Metropolitan Police let officers use an unapproved shoplifting app for eighteen months, uploading three children's details among 179 people. Its named fix is a training course the regulator had already reprimanded it for under-using.
Estimated reading time: 7 minutes
In short. The Information Commissioner reprimanded the Metropolitan Police Service (MPS) on 23 September 2026 over the unauthorised use of Auror, a retail-crime platform, by roughly 500 officers between March 2023 and September 2024, uploading the personal data of 179 people, three of them under 18, without a contract, a data protection impact assessment or any corporate approval (page 8) [1]. The force's named fix is more staff training. The Commissioner's own notice against the same force two months earlier, issued 27 July 2026, had already found that the exact training course MPS now points to was below half complete, after the force gave four different sets of figures in fifteen months (pages 28 to 30) [2]. Three documented mistakes: four stars.
In spring 2023, retailers using Auror, a New Zealand-owned platform that lets shops record shoplifting incidents, started handing Metropolitan Police officers QR codes at store visits. Scan the code, and an officer could set up a free law enforcement account in minutes, no approval from anyone at the Met required (page 6) [1]. By the time a security team manually blocked the site eighteen months later, roughly 500 officers and staff had created accounts, 375 of them active, searching Auror for shoplifting reports in their patch and sharing information back with retailers to help build cases (page 8) [1]. Nobody at the Met had signed a contract with Auror Europe Limited. Nobody had assessed the risk. The platform was never meant to be there in the first place.
A form nobody checked
The closest the Auror platform came to formal approval was a single Mobile Applications Approval Meeting on 27 June 2023, considering a mobile app version an officer wanted installed on frontline devices. The officer completing the request form wrote that a desktop version of Auror was "already in use" within the Met, implying it had already been cleared (page 11) [1]. It had not. No one on the approval board checked. No representative of the Met's Data Protection Team was in the room, despite the Met's own obligation under the Data Protection Act to involve its data protection officer in exactly this kind of decision (page 27) [1]. The same officer indicated on the form that a data protection impact assessment was not required. That answer went unchallenged too. The Commissioner's own view: had the Data Protection Team actually been consulted, "it could have exposed the false nature" of the claim that Auror was already approved (page 28) [1]. The mobile app itself never worked on Met devices. The website version that officers actually used was never considered by any board at all.
What ended up on a shop-watch platform
What officers shared with Auror, and through it with retailers, included suspects' names, dates of birth and, for two people, home addresses. Three of the 179 affected people were under 18 (page 14) [1]. The Met's own Security Incident Reports, once the use came to light internally in August and September 2024, recorded that an officer had uploaded "the full names of suspects they recognised in the CCTV images shared by the retailer" (page 9) [1]. The Met later told the Commissioner that "officers should not have routinely been sharing information on individuals such as date of birth or addresses as it was not necessary" (page 24) [1], which the Commissioner accepted as the correct standard and then found the Met had broken.
The fix the Met describes
Once the breach surfaced, the Met suspended Auror, stood up a Gold Group of senior officers, data protection staff and lawyers, and eventually built a new approval process it calls the Data Capability Assurance Framework. It signed a formal contract with Auror Europe Limited on 11 December 2025, completed a data protection impact assessment, and reinstated the platform on 26 January 2026 with officers restricted to viewing data only, unable to upload or share free text (page 19 to 21) [1]. In its formal response to the Commissioner, the force said it had "significantly strengthened its approach to third-party supplier assurance and oversight", pointing to a new national Risk Ledger platform shared across UK policing (page 20) [1]. Among the measures the force lists as already delivered: ensuring "universal completion" of its "Managing Information" training course for frontline staff (page 16) [1].
The same regulator's own numbers
"Managing Information" is not a new course. The Met introduced it after the Commissioner reprimanded the force in December 2021 over a different unauthorised platform, Clearview AI's facial recognition tool, used by two officers without a contract, a lawful basis or a completed impact assessment (page 38) [1]. This site has already torn down a separate, 27 July 2026 ICO Reprimand and Enforcement Notice against the Met, issued two months before the Auror notice, over two different data breaches: a stalking victim's new address reaching her alleged stalker, and 18 people's details exposed to each other in a misdirected email [5]. That notice's own enforcement basis was that the Met was "failing to ensure the provision of appropriate data protection training for staff", a continuing infringement in its own right (page 6) [2]. The training named throughout is "Managing Information". By December 2024, the Met's own completion figures for it stood at 23.98% of staff and 28.41% of officers for one version, and 1.26% and 1.73% respectively for a newer version launched that same month (pages 28 to 29) [2]. The Met itself called these figures "disappointing and not what we expected" (page 29) [2]. Asked for an update, the force told the Commissioner in its representations that the training was now "fully embedded", without supplying a single percentage. A further enquiry had to be sent before the Met produced updated numbers: as of May 2026, four months before the Auror notice was signed, 48.3% of operational staff and 29.1% of non-operational staff had completed the latest version (page 30) [2].
A repeat the Commissioner names outright
The Auror notice does not treat this as background colour. It states directly that the unauthorised use of Auror "indicates that the measures set out" after the Clearview reprimand "were not sufficient to ensure an appropriate level of security for the personal data processed by the MPS as they did not prevent a repeat of the type of incident which gave rise to the Clearview Reprimand" (page 39) [1]. It goes further: having "acknowledged and welcomed" the Met's description of its strengthened controls, the Commissioner concludes that "the MPS's reliance upon training and policies is insufficient without such measures being supported by appropriate technical measures" (page 40) [1]. Annex 1 of the Auror notice itself notes, in the same paragraph that requires the Met to fix its training within six months, that the force's "internal training and guidance practices have also been the subject of separate investigations and subsequent enforcement action" (page 45) [1], a direct footnote back to the 27 July notice.
Still open
The Reprimand covers the Auror incident specifically. The Enforcement Notice covers something wider: a standalone "Governance Infringement", the Met's ongoing failure to ensure that any third-party platform its officers use is properly assessed, approved and overseen. The Commissioner dates that failure to 25 May 2018, when the relevant law took effect, and finds it "continues as of the date of this Notice" (page 22) [1], more than eight years and two reprimands later. Annex 1 now requires the Met to review all unapproved third-party platforms within three months, assess or block them within six, and test whether any of it actually worked within twelve (pages 43 to 46) [1], a fresh compliance programme layered on top of the one the July notice already set running.
The claims, tested
| The notice's own words | What the record shows | Verdict |
|---|---|---|
| The Met has "significantly strengthened its approach to third-party supplier assurance and oversight", including ensuring "universal completion" of its Managing Information training (pages 16, 20) [1] | The Commissioner's own 27 July 2026 notice against the same force found completion of that exact course at 48.3% of operational staff and 29.1% of non-operational staff as of May 2026, the most recent figures on record (page 30) [2] | "Universal" describes a course most non-operational staff had not completed four months before the Met cited it as evidence of a fix |
| The Auror Infringements were a one-off breach, now remedied by reinstating the platform with controls on 26 January 2026 (pages 19 to 21) [1] | The Commissioner separately finds the Governance Infringement, covering any unapproved third-party platform, "continues as of the date of this Notice" and dates it to 25 May 2018 (page 22) [1] | Fixing Auror does not touch the systemic gap the Enforcement Notice is actually aimed at |
| The Met's post-Clearview measures, including Managing Information training, show a force that learns from reprimands (page 38) [1] | The Commissioner's own words: those measures "were not sufficient" and "did not prevent a repeat of the type of incident which gave rise to the Clearview Reprimand" (page 39) [1] | The regulator that accepted the fix in 2021 is the same regulator now saying it did not work |
Credit where due
Once the Met found out what its own officers were doing, it moved. Access was blocked within days of the second internal security report, Auror was told to strip Met branding from its marketing, and the force's Business Crime Team checked directly with retailers and found none had used the shared data to ban anyone, pursue civil action, or share it onward (pages 15 to 16) [1]. The reinstated platform does carry real new controls: read-only access, no free text, mandatory platform-specific training before anyone gets back in (page 21) [1]. That is a materially different posture to 2023, when nobody was watching at all.
Verdict
Four stars, from three documented mistakes. The Metropolitan Police answered one unauthorised-platform scandal with the same training course the regulator was, at that exact moment, separately reprimanding it for failing to get staff to complete. The Commissioner's own notice says so, in its own footnotes, without needing this site to join the two documents together. A force that has now been found short on third-party data governance twice in under five years, with the second finding explicitly invoking the first, is not a force that has fixed the underlying problem. It has fixed one platform.
The star score counts three documented mistakes: the Met's claim of "universal completion" of its named training fix is contradicted by the regulator's own, separately published figures showing well under half of relevant staff had completed the current version as of the most recent data available; the Met's remedy addresses the specific Auror platform while the Commissioner's own Governance Infringement finding, covering any unapproved third-party platform, is recorded as unresolved and ongoing since 25 May 2018; and the Commissioner's own notice states in terms that the measures introduced after the Met's 2021 Clearview reprimand, including this same training course, "did not prevent a repeat" of the same type of incident. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding on whether a reprimand, rather than a fine, was the correct sanction for either notice, a judgement for the Commissioner alone, or on the adequacy of the read-only controls now in place on the reinstated platform, which the notice describes in some detail. The finding is narrower: that the force's own account of its fix rests on a course the regulator's own parallel enforcement record shows was not being completed, and that the Commissioner's own document says as much. Checked directly against both the 48-page Auror notice and the 65-page July notice (full text, pypdf layout extraction), both fetched 31 October 2026.
Sources
- Chief Constable Commissioner for the Metropolis / Metropolitan Police Service (MPS): Reprimand and Enforcement Notice, Auror Platform (PDF), Information Commissioner's Office, dated 23 September 2026
- Chief Constable Commissioner for the Metropolis / Metropolitan Police Service (MPS): Reprimand and Enforcement Notice (PDF), Information Commissioner's Office, dated 27 July 2026
- Metropolitan Police Service, Information Commissioner's Office, enforcement action page
- ICO takes action against Metropolitan Police Service over information governance failures, Information Commissioner's Office, published 14 October 2026
- "The Metropolitan Police exposed a stalking victim's new address to the man she was hiding from, and the regulator's own notice says that exact risk then came true. No fine was ever discussed.", Tracked Changes, 5 October 2026