Metropolitan Police's unchecked use of shoplifting platform lands force in trouble with data watchdog

The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) and issued an enforcement notice after officers used a retail crime platform without the force's approval or required data protection checks.

Between March 2023 and September 2024, MPS officers registered around 500 free accounts on Auror, a platform retailers use to record crimes such as shoplifting.

The force had not formally procured the service or completed the required data protection checks.

Retailers such as supermarkets encouraged officers to use Auror and directed them to the platform to access CCTV footage.

Auror Europe, registered in England and Wales, is a subsidiary of New Zealand-based Auror.

The platform allows retailers to share incident reports, images, and CCTV footage.

Retailers pay for access through a browser or mobile app, while police partners use it free of charge.

The force had not completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe, the ICO says.

Between August and September 2024, two separate internal security reports were filed regarding officers' use of Auror.

The first related to officers uploading the names of suspects they recognized from CCTV footage, and the second pertained to officers collecting CCTV footage from the platform despite no checks being made on it.

Access to Auror was blocked as of September 26, 2024.

The MPS data protection officer (DPO) informed the ICO of the force's use of Auror in December 2024 during discussion about a separate matter.

The watchdog launched a formal probe in April 2025.

The ICO found that officers unlawfully uploaded personal data relating to 179 people, including three children, to Auror.