Britain's data watchdog has reprimanded the Metropolitan Police Service after officers and staff shared sensitive suspect information, including data on three people under 18, on an unapproved retail crime platform for over 18 months without detection, exposing 179 individuals through 500 accounts created by MPS officers and staff.
The finding, announced by the Information Commissioner's Office (ICO) on 14 October 2026, mirrors a near-identical failure from 2021, when the same force was censured for allowing officers to deploy Clearview AI's facial recognition system without authorisation.
It is the second time in five years the ICO has formally reprimanded Britain's largest police service for the same class of data governance failure.
'Ongoing Failure': How the ICO Assessed an Undetected Data Breach
The ICO found that the Metropolitan Police Service had 'failed, and continues to fail, to implement appropriate technical and organisational measures to ensure that the processing of personal data by its officers and staff using third-party online services is subject to appropriate levels of assessment, approval and organisational oversight.'
The names and dates of birth of 179 people were shared on a platform designed for tracking shoplifters; home addresses were included in a small number of cases; and three of those individuals were under 18.
Of those 179 individuals, 59 were subsequently arrested, charged, convicted or circulated as wanted persons following their identification through the Auror platform, according to the ICO's investigation.
Officers and staff created 500 accounts on the service, of which 375 were actively used. Officers' own warrant numbers and email addresses were also among the data exposed.
Auror, owned by a New Zealand-based company and used by major UK retailers including Tesco, Boots and Marks and Spencer, allows retailers to record shoplifting incidents using facial recognition, automatic number plate recognition and AI.
Officers given free accounts could review CCTV footage uploaded by retailers and share suspect information in return. At the time, the force had no formal agreement in place for any of this.
Three Chances, 18 Months: How the Metropolitan Police Missed Its Own Data Breach
The ICO's investigation found that the MPS had multiple concrete opportunities to restrict Auror before it finally acted in September 2024; officers had been using the platform since March 2023.
In June 2023, an internal request to access a mobile version of the platform, Auror Frontline, was approved in principle by an internal committee 18 days later without raising any alerts.
In August 2024, a security incident report found that officers were uploading suspect names directly to the platform. The force was informed. It waited. A second incident report weeks later finally prompted restrictions, in September 2024.
The force not only failed to prevent the original breach; it signed a formal contract with Auror Europe in December 2025, even and especially as the ICO's investigation into the very same platform was already under way, and deployed the service operationally across 14 London boroughs by January 2026.
🔴 NEWS: Met Police officers unlawfully shared the personal information of 179 people, including three children, on an unauthorised retail crime platform.
— Big Brother Watch (@BigBrotherWatch) October 15, 2026
🔸 Names and home addresses were uploaded to a platform called Auror.
🔸The platform was never risk assessed, reviewed or… pic.twitter.com/vfV1vyIMRu
What Officers Were Actually Uploading to an Unvetted Retail Platform
The data shared on Auror included names, dates of birth and, in a small number of cases, home addresses, as well as references to prior facial recognition searches in some instances.
The ICO noted that use of the platform created a 'high risk' to those affected, including misidentification as an offender, being banned from retail premises, having movements restricted or reputational damage.
Among those exposed were three people under 18. The MPS says it alerted the ICO as soon as it became aware of the breach in September 2024. The ICO says it only learned of the incident during a discussion about a separate matter in December 2024.
Quadrupled Outcomes, Active Reprimand: The MPS Contradiction That Remains Unresolved
David Doodson, ICO Head of Investigations, said that police forces hold large volumes of sensitive personal information and must have robust safeguards in place before introducing new systems or platforms. The MPS, he said, had failed to demonstrate that officers understood their data protection obligations or had received regular training to that effect.
The MPS has accepted the ICO's findings, acknowledging that officers used the platform 'in good faith to identify and arrest shoplifters' but that 'relevant security and data protection work' had not been completed at the time.
Before the January 2026 re-launch, the force completed a data protection impact assessment, signed a formal contract with Auror Europe and introduced access controls restricting officers from uploading data directly. Officers must now use a secure authentication system to access the platform.
On 4 August 2026, the force announced the platform had quadrupled positive outcomes for shoplifting offences, with a reported 29.4% resolution rate against a previous baseline of 7.3% across its pilot boroughs.
Whether those controls satisfy the ICO's finding of 'ongoing failure' or address only the original unauthorised deployment is a question the reprimand and its accompanying enforcement notice leave open.
