Summary

• Around 500 accounts were created on an unapproved retail crime platform, with 375 used for policing activity.
• Information about 179 people, including three children, was uploaded during the period examined.
• The force restored access after implementing safeguards, but the regulator requires stronger organisation-wide governance controls.

The Metropolitan Police must strengthen oversight of third-party technology after the Information Commission found that officers and staff had used an unapproved retail crime intelligence platform to share personal information without adequate governance and data protection safeguards.

The regulator publicised its findings on 14 October, following a reprimand and enforcement notice issued in September. The investigation concerns the Metropolitan Police Service’s responsibility for authorising external systems and ensuring that personal information is processed in accordance with the applicable legal requirements.

Approximately 500 accounts were created on the platform between March 2023 and September 2024, with 375 used for policing activities. The regulator found that information concerning 179 people, including three children, had been uploaded between January and September 2024 as part of attempts to identify individuals suspected of shoplifting.

The information included names, dates of birth and, in a small number of cases, home addresses. The fact that individuals were recorded in connection with suspected offences does not establish that they had been convicted or that the underlying allegations were proven.

Officers had adopted the platform without formal approval from the force. The Information Commission concluded that personal information had been processed unlawfully in relevant circumstances and that the Metropolitan Police had failed to complete appropriate assessments and implement effective organisational controls.

The enforcement action concerns the conduct and responsibilities of the police organisation. It is not a finding that the external platform suffered a cyberattack or that every user of the service operated unlawfully.

Technology adoption overtook governance

Retail crime intelligence systems allow businesses and authorised law enforcement users to exchange information associated with suspected offending. They can make incident reports and supporting records easier to retrieve, potentially reducing delays that arise when individual businesses must respond to separate requests.

However, an operationally useful service can introduce legal and organisational risks if employees begin using it before the organisation has determined who may access it, what data can be shared and the purposes for which that information may be processed.

The Metropolitan Police findings show how that problem can extend beyond an isolated instance of unauthorised software use. Hundreds of accounts existed across a period exceeding a year, despite the absence of formal approval and the required data protection assessment.

The regulator concluded that the force had failed to implement adequate technical and organisational measures to protect personal information and ensure that its approval processes for third-party technologies were followed.

It also found that the Metropolitan Police had not undertaken a data protection impact assessment before conducting the high-risk processing. Such assessments are intended to identify potential consequences for affected individuals and establish safeguards before processing begins.

Police information can be particularly sensitive because it may concern people who have not been convicted of an offence. Information that assists an investigation must still be handled according to the necessity, proportionality and other legal requirements relevant to the particular activity.

Where external services allow records to be exchanged between police and commercial organisations, governance also needs to establish responsibilities for access, retention and subsequent use. An account held by an individual officer does not itself provide a sufficient legal basis for uploading personal information.

The regulator’s findings have implications for other organisations whose employees use external tools to collaborate with suppliers or partners. Access to a service may be technically straightforward even when the necessary legal and security arrangements have not been completed.

Existing improvements did not resolve every concern

The Metropolitan Police suspended use of the platform in September 2024 after concerns about the arrangements came to light. It subsequently introduced additional safeguards, including stronger governance procedures, staff training, formal contractual controls and a data protection impact assessment.

Those changes preceded the platform’s reintroduction in January 2026. The Information Commission acknowledged the improvements when reaching its findings, but concluded that wider deficiencies remained in the force’s arrangements for identifying and authorising third-party services.

The enforcement notice therefore requires more than reviewing the earlier use of a single platform. The force must improve the processes through which external systems are identified, assessed and approved, strengthen employee awareness and test whether controls work in practice.

It must also provide periodic updates to the regulator on implementation. The action is a formal requirement to address identified shortcomings, rather than a financial penalty or a general prohibition on the use of retail crime technology.

The investigation illustrates the limitations of relying solely on procurement approval lists or written technology policies. An organisation may have formal procedures while individual teams continue to adopt services through arrangements that do not trigger central review.

Technical discovery controls, employee training and operational accountability therefore need to work together. A department must know which services process information on its behalf and be able to intervene when use begins outside approved arrangements.

Those requirements continue after a technology is introduced. Changes to a platform’s functions, access arrangements or data-sharing practices can alter its risk profile, making ongoing review necessary even where the initial adoption was properly authorised.

Separate from the Palantir dispute

The findings concern a retail crime intelligence platform identified in reporting as Auror. The regulator’s principal announcement describes the system by its purpose, without naming the supplier, and does not attribute the Metropolitan Police’s governance failures to the platform provider.

The matter is also separate from the Metropolitan Police’s recent dispute over a proposed software procurement involving Palantir. Techopia has already covered that settlement, which involves a different contract and legal questions.

Both developments concern scrutiny of technology used by policing organisations, but they must not be presented as parts of the same investigation or as evidence of wrongdoing by the same supplier.

The Information Commission’s findings establish an organisational failure to approve and govern external information processing properly. The force has already changed the arrangements surrounding the particular platform, while the enforcement notice requires it to demonstrate that comparable failures can be prevented across its wider technology estate.