The Met Police data leak case has resulted in a formal reprimand and enforcement notice from the Information Commissioner’s Office. The action concerns officers and staff using the Auror retail crime platform without formal approval or the required data protection checks.
The ICO announced its action on 14 October 2026, after issuing the combined Reprimand and Enforcement Notice on 23 September 2026. Although commonly described as a data leak, the case does not involve a reported cyber attack or compromise by external threat actors.
What happened in the Met Police data leak case?
Metropolitan Police Service personnel began accessing Auror in March 2023. Auror is a third-party retail crime intelligence-sharing platform provided in the UK by Auror Europe Limited, part of New Zealand-based Auror.
The platform allows retailers and law enforcement users to share information associated with suspected retail crime. Reports indicate that retailers encouraged officers to create free accounts so they could access material such as CCTV evidence and information about suspected shoplifters.
However, the platform had not passed through the MPS’s formal approval, procurement and data protection processes. Its operational use therefore began without the governance arrangements expected when police personnel process personal information through an external service.
Around 500 MPS accounts were created on Auror. Of these, 375 were actively used for policing activities. The number of accounts and duration of use showed that this was more than an isolated decision by a single member of staff.
Between January and September 2024, MPS users uploaded personal information relating to 179 people, including three people under 18. The information included names, dates of birth and, in a small number of cases, home addresses.
The purpose was to help identify suspected shoplifters, but the ICO found that some sharing was not necessary for law enforcement purposes. This meant that the processing did not meet the applicable legal requirements, irrespective of whether officers believed the platform could support their investigations.
ICO findings behind the Met Police reprimand
The ICO identified failures under three sections of the Data Protection Act 2018. These findings covered the lawfulness of the processing, the controls used to protect personal information and the absence of a required risk assessment.
Unlawful processing under section 35
Section 35(1) requires processing for a law enforcement purpose to be lawful and fair. In the Met Police data leak case, the ICO found that personal information was unlawfully processed where disclosure through Auror was not necessary for law enforcement purposes.
Necessity is an important test. An organisation cannot justify sharing information through a third-party platform solely because the service is useful or convenient. It must establish why the processing is required and ensure that the legal conditions are met before information is uploaded.
Insufficient technical and organisational measures
The ICO also found a failure to implement appropriate technical and organisational measures under section 40 of the Act. The MPS lacked effective controls to ensure that third-party technologies were assessed and approved before personnel used them to process personal information.
This aspect of the Met Police data leak is particularly significant because the weakness extended beyond settings inside the Auror platform. It concerned the wider ability of the organisation to prevent staff from adopting an external technology before privacy, security, contractual and operational reviews had been completed.
No completed data protection impact assessment
Under section 64(1), organisations must conduct a data protection impact assessment when planned law enforcement processing is likely to create a high risk to people’s rights and freedoms. The MPS did not complete the required assessment before Auror was used operationally.
A DPIA should identify the information being processed, the purpose and necessity of that processing, potential effects on individuals, and measures for reducing risk. The involvement of criminal allegations, policing activity and children made a documented assessment especially important.
Timeline of the Auror data-sharing failure
The Met Police data leak developed over several years, from the platform’s initial unapproved use to the ICO’s public announcement. The confirmed timeline is:
- March 2023: MPS officers and staff begin accessing Auror without formal approval.
- January to September 2024: Users upload personal information relating to 179 people, including three children.
- September 2024: The MPS suspends its use of Auror.
- January 2026: Auror is reintroduced after additional governance and safeguards are implemented.
- 23 September 2026: The ICO issues a combined Reprimand and Enforcement Notice to the Commissioner of Police of the Metropolis.
- 14 October 2026: The ICO publicly announces the regulatory action.
- 15 October 2026: Wider reporting details the findings, account numbers and number of affected people.
The MPS action involving Auror is separate from the ICO reprimand issued on 5 August 2026 concerning two unrelated disclosure incidents. The cases should not be conflated.
No evidence of external exploitation
Despite the Met Police data leak description, the ICO did not report hacking, malware, stolen credentials or exploitation by a threat actor. No indicators of compromise, malicious domains, file hashes or attack tools have been published because this was not an external cyber intrusion.
The issue was operational use of a legitimate third-party service without sufficient authorisation and governance. The personal information was uploaded by MPS personnel as part of policing activity, rather than extracted by an attacker exploiting a software vulnerability.
No Auror software version was identified in the ICO material, and no product vulnerability was reported. The regulatory findings relate to how the platform was adopted and used, not to a security flaw in Auror itself.
Safeguards introduced before Auror returned
The MPS suspended the platform in September 2024. Before reintroducing it in January 2026, it implemented stronger governance arrangements, staff training, formal contractual controls and a completed DPIA.
However, the ICO concluded that action was still required to address the wider risk of personnel using unapproved third-party technologies. The enforcement notice therefore focuses on measures designed to ensure that external platforms are properly assessed and authorised before they process personal information.
The ICO announcement does not mention or impose a monetary penalty. A reprimand records the regulator’s findings, while an enforcement notice requires specified corrective action. Failure to comply with an enforcement notice can create further regulatory consequences.
What UK organisations should review
The Met Police data leak offers a specific warning about unsanctioned software and cloud services. Organisations using platforms for investigations, loss prevention, CCTV sharing or incident reporting should confirm that approval occurs before live personal data is entered.
- Identify external platforms currently used by staff outside formal procurement channels.
- Complete a DPIA before starting processing that could create a high risk to individuals.
- Document the lawful basis, necessity and permitted purpose for each type of data sharing.
- Put contracts, access controls, retention rules and oversight arrangements in place.
- Train staff to use only approved services when handling personal or investigative information.
The central lesson is that a useful platform does not remove an organisation’s legal responsibilities. Approval, necessity, contractual controls and privacy assessment must come before operational use, particularly when information concerns alleged offending or children.
Originally reported by infosecurity-magazine.com.
