Met Police Uploaded Data to Auror Without Privacy Checks or Approval
The ICO issued an enforcement notice after officers used a retail crime platform unlawfully, uploading details of 179 people without required safeguards.
Key points
- The Information Commissioner's Office reprimanded the Metropolitan Police Service for using Auror without formal procurement or data protection checks.
- Officers uploaded personal data for 179 individuals, including names, dates of birth and home addresses, between March 2023 and September 2024.
- Access to the platform was blocked in September 2024 after internal security reports highlighted the unapproved usage and lack of impact assessments.
London’s Metropolitan Police Service allowed officers to upload personal data to a retail crime platform without completing mandatory privacy checks or obtaining corporate approval, according to the Information Commissioner’s Office. The watchdog has issued an enforcement notice following an investigation into this unchecked use of the Auror system.
Root cause
The core issue was the absence of formal procurement procedures and data protection impact assessments for the Auror platform. The force had not established data-sharing agreements with Auror Europe, the UK subsidiary of the New Zealand-based vendor. Retailers, including supermarkets, encouraged officers to use the service to access CCTV footage, but the police organisation failed to implement the necessary legal safeguards before allowing access.
Attack path
Between March 2023 and September 2024, approximately 500 free accounts were registered by Metropolitan Police officers. The platform allows retailers to share incident reports, images and CCTV footage. Police partners accessed the service at no cost, while retailers paid for browser or mobile app access. Officers used these accounts to upload suspect details and collect footage without any verification processes in place.
Affected versions
The incident involves the web and mobile application interfaces of the Auror platform as accessed by police partners. The data breaches affected 179 individuals, including three children. For 128 people, only names were uploaded; for 49, names and dates of birth were added; and for two individuals, names, dates of birth and home addresses were recorded on the system.
Mitigation
- Block access to unapproved third-party platforms immediately upon discovery of unauthorised usage.
- Conduct regular audits of officer accounts on external services to ensure compliance with procurement rules.
- Implement mandatory data protection impact assessments before any new technology is adopted for operational use.
- Establish clear data-sharing agreements with all vendors handling personal information from investigations.
Why it matters
Security teams must understand that using unvetted software creates significant legal and operational risks. Organisations often assume that free tools are low-risk, but they may lack essential privacy controls. It is crucial to verify that any platform handling sensitive data has undergone proper security reviews. Teams should ensure that data processing activities are documented and approved before deployment. Unchecked usage can lead to regulatory penalties and loss of public trust.
Background: Personal data
Small businesses accumulate personal data through routine operations like payroll, customer inquiries, and web forms. Managing this safely requires mapping every data flow, deleting what you no longer need, and restricting internal access so that staff only see records required for their specific tasks.
Read the full guide: Personal data for small businesses: how to collect less and survive
What to do and how to stay safe: Auror
- Review all third-party applications currently in use by your organisation to confirm they have undergone proper procurement and privacy checks.
- Ensure that data-sharing agreements are in place with any vendor that processes personal information on your behalf.
- Monitor user activity on external platforms to detect unauthorised uploads or access patterns that deviate from approved procedures.
- Once the vendor provides an update or guidance, implement any recommended security controls to prevent similar data exposure in the future.
Step-by-step guide: Opting Out of Data Brokers: The Mechanics and Limits of Removal
General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the data upload?
The ICO found that personal data relating to 179 people, including three children, was unlawfully uploaded to the Auror platform.
When was access to the platform blocked?
Access to Auror was blocked for Metropolitan Police officers as of 26 September 2024.
What data was uploaded without checks?
Officers uploaded names, dates of birth and, in two cases, home addresses for suspects identified from CCTV footage.
