Ethical Hacking News
The Metropolitan Police Service has been reprimanded by the Information Commissioner's Office for its unchecked use of the Auror platform, which led to the unauthorized upload of 179 individuals' personal data. The force has since strengthened its safeguards and completed necessary data protection checks to comply with regulations.
The Metropolitan Police Service (MPS) unlawfully uploaded personal data of 179 individuals onto the Auror platform. The ICO found that the MPS failed to complete necessary data protection checks and establish data-sharing agreements with Auror Europe. The ICO's investigation began in April 2025 after the force's data protection officer informed the regulator of the platform's use. The ICO warned the MPS to strengthen its safeguards against improper use of third-party tools and provide periodic progress updates. The MPS implemented stricter controls and completed necessary checks to ensure compliance with data protection regulations. The incident highlights the need for increased transparency and accountability within law enforcement agencies. The ICO's warning demonstrates that failure to comply with data protection regulations can have serious consequences.
The Metropolitan Police Service (MPS) has found itself in hot water after it was revealed that officers had been unlawfully uploading personal data of 179 individuals onto the Auror platform, a commercial tool used by retailers to record crimes such as shoplifting. The incident has sparked a stern warning from the Information Commissioner's Office (ICO), which has reprimanded the force for its failure to complete necessary data protection checks and establish data-sharing agreements with the platform's provider, Auror Europe.
The ICO's investigation into the MPS's use of Auror began in April 2025, after the force's data protection officer (DPO) informed the regulator of the platform's use in a discussion about a separate matter. The ICO's probe uncovered that officers had been using the platform without proper oversight, leading to the unauthorized upload of personal data, including names, dates of birth, and home addresses.
The ICO's findings were particularly damning, with the regulator stating that the MPS had failed to implement adequate safeguards to prevent unauthorized access to the platform. The force had not completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe, which is a subsidiary of New Zealand-based Auror.
The ICO's warning to the MPS is not merely a reprimand, but rather a call to action. The regulator is urging the force to strengthen its safeguards against improper use of third-party tools and to provide periodic progress updates on its efforts to comply with data protection regulations.
In response to the ICO's findings, the MPS has implemented stricter controls and a pilot scheme, which has allowed officers in 14 London boroughs to use Auror once again. The force has also completed the necessary legal, security, commercial, and data protection checks required to ensure compliance with data protection regulations.
While the MPS has taken steps to rectify the situation, the incident has raised important questions about the force's handling of sensitive data and its reliance on soft controls to prevent unauthorized access to third-party tools. The ICO's warning serves as a reminder that data protection regulations are in place to protect individuals' personal data and that organizations must take proactive steps to ensure compliance.
The incident also highlights the need for increased transparency and accountability within law enforcement agencies. The MPS's failure to complete necessary data protection checks and establish data-sharing agreements with Auror Europe demonstrates a lack of oversight and a culture of impunity. This must be addressed through robust internal controls, regular audits, and increased transparency.
In conclusion, the MPS's Auror misstep serves as a cautionary tale about the importance of data protection regulations and the need for organizations to take proactive steps to ensure compliance. The ICO's warning and the MPS's response demonstrate that failure to comply with data protection regulations can have serious consequences, including reputational damage, fines, and loss of public trust.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Metropolitan-Polices-Auror-Misstep-A-Cautionary-Tale-of-Unchecked-Data-Access-and-the-Consequences-of-Failure-to-Comply-with-Data-Protection-Regulations-ehn.shtml
https://www.theregister.com/security/2026/10/15/metropolitan-polices-unchecked-use-of-shoplifting-platform-lands-force-in-trouble-with-data-watchdog/5303061
Published: Thu Oct 15 05:55:56 2026 by llama3.2 3B Q4_K_M
