The Metropolitan Police Service (‘the Met’) has landed itself in hot water with the UK’s data regulator, the ICO, after members of staff uploaded sensitive data to an unauthorized third-party platform.

Between March 2023 and September 2024, officers and staff in the Greater London police force used the Auror intelligence-sharing platform as part of a crackdown on shoplifting, despite it not being formally approved for use.

Auror is a third-party, cloud-based platform from SaaS provider Auror Europe Limited, a wholly-owned subsidiary of New Zealand firm Auror Limited.

It's accessible via a website and mobile application and is mainly used by retailers to record, manage and analyse incidents of retail crime. It does this using a range of technologies, including facial recognition, automatic number plate recognition (ANPR) and AI.

Retailers can upload incident reports, images and CCTV footage relating to suspected shoplifting and other retail-related offenses, which can then be shared for free with law enforcement authorities.

This may seem not only harmless but actively helpful in the detection and prosecution of crime, however the tool wasn’t subjected to the usual data protection assessments or governance before use.

"Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it," said David Doodson, ICO head of investigations.

"Whilst new technologies can deliver significant operational benefits, organizations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight."

Specifically, said the ICO, the Met unlawfully processed personal information without individuals’ consent and in situations where sharing wasn't actually necessary for law enforcement purposes.

In all, around 500 accounts were created, with 375 actively used for policing activities. The ICO found that, between January and September 2024, personal information relating to 179 people – three of whom were under the age of 18 – was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting.

This included names, dates of birth and, in a small number of cases, home addresses.

The police force also failed to put the appropriate technical and organizational measures in place to make sure that personal information was protected or that assessment and approval processes for third-party technologies were followed.

Additionally, the ICO found that, not only did the Met not carry out a data protection impact assessment, it still isn't ensuring that only approved third-party technologies are used to process personal information.

Since the issue first emerged, MPS has tightened up its procedures. However, the ICO said it still needs to do more.

It has ordered the force to strengthen its approach to identifying, assessing and approving any third-party services used to process personal information. It must also review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of the measures it has in place.

Controlling the spread of shadow AI

Shadow IT – and shadow AI in particular – is a growing problem. A survey from SailPoint earlier this year found that two-thirds of organizations can’t account for the information staff are sharing with AI platforms and large language models (LLMs). It also found that 35% of staff are sharing data through external tools, rather than approved internal applications.

"This action should send a message across the policing sector, and beyond: if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset," said Doodson.

"Where organizations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect."