Full Report
Officers unlawfully uploaded 179 people's details to Auror without required privacy checks or corporate approval
Analysis Summary
# Regulation/Compliance: UK Data Protection Act 2018 / UK GDPR (Law Enforcement Processing)
## Overview
This compliance matter concerns the unlawful processing of personal data by the Metropolitan Police Service (MPS) via a third-party retail crime platform (Auror). The Information Commissioner’s Office (ICO) found that the force failed to conduct mandatory privacy assessments and lacked governance controls to prevent officers from using unapproved software to process suspect data.
## Key Details
- **Issuing Authority:** Information Commissioner’s Office (ICO)
- **Effective Date:** Incident occurred March 2023 – Sept 2024; Enforcement Action issued Oct 2026.
- **Jurisdiction:** United Kingdom (London/Metropolitan Police)
- **Status:** Final (Reprimand and Enforcement Notice issued)
## Requirements
### Mandatory Requirements
1. **Data Protection Impact Assessments (DPIAs):** Organizations must complete a DPIA before using new technologies to process personal data, particularly for law enforcement purposes.
2. **Data Sharing Agreements (DSAs):** Formal contracts must be in place when sharing personal data with third-party platforms (e.g., Auror Europe).
3. **Internal Governance/Corporate Approval:** Third-party tools must undergo formal procurement and security vetting before operational use.
4. **Technical Access Controls:** Organizations must implement robust technical blocks to prevent the use of unapproved software, rather than relying solely on "soft controls" (policies/training).
### Recommended Practices
1. **Regular Audit of Web Controls:** Periodically test web filtering and monitoring systems to ensure unapproved platforms are blocked.
2. **DPO Engagement:** Consult the Data Protection Officer at the start of any new technology pilot.
## Affected Organizations
- **Industries:** Law Enforcement, Public Sector, and Retailers using crime-sharing platforms.
- **Organization Size:** All (specifically those handling sensitive criminal justice data).
- **Geographic Scope:** United Kingdom (England and Wales).
## Compliance Timeline
- **March 2023:** Unauthorized use of Auror began.
- **Sept 26, 2024:** Access to Auror blocked after internal security reports.
- **Dec 2024:** DPO notified the ICO of the breach.
- **April 2025:** ICO launched a formal probe.
- **Oct 2026:** Final Reprimand and Enforcement Notice issued.
## Implementation Guidance
### Assessment Phase
- Audit all software currently used by staff to identify "shadow IT" or unvetted third-party platforms.
- Review existing data processing activities involving third-party retailers or crime-prevention tools.
### Implementation Phase
- Implement technical blocks (firewall/endpoint filtering) on unapproved domains.
- Establish a formal "Third-Party Risk Management" (TPRM) workflow for new software requests.
- Complete DPIAs for all platforms handling suspect or victim data.
### Validation Phase
- Conduct periodic vulnerability scans and logs reviews to ensure no unauthorized data uploads are occurring.
- Provide evidence of "hard controls" to regulators during audits.
## Technical Requirements
- **Endpoint/Network Filtering:** Block access to unapproved SaaS platforms.
- **Logging and Monitoring:** Alerts must be triggered if officers attempt to access or upload data to non-whitelisted domains.
- **Data Minimization:** Ensure only necessary fields (e.g., names) are uploaded only after legal basis is established.
## Penalties & Enforcement
- **Fines:** While the ICO issued a reprimand (non-monetary in this instance), UK GDPR allows for fines up to £17.5m or 4% of turnover.
- **Other Consequences:** Formal Enforcement Notice (legally binding), mandatory progress updates to the regulator, and public reputational damage.
- **Enforcement:** The ICO monitors compliance with the Enforcement Notice; failure to comply can lead to further legal action.
## Related Standards
- **UK GDPR / Data Protection Act 2018 (Part 3):** Specifically addresses Law Enforcement processing.
- **ISO/IEC 27001:** Alignment on Third-Party Provider Relations and Access Control.
- **NIST Privacy Framework:** Alignment on Data Processing Ecosystem Risk Management.
## Resources
- **Official Documentation:** [ico[.]org[.]uk] - Information Commissioner’s Office.
- **Guidance Documents:** ICO Guidance on DPIAs and Law Enforcement processing.
## Practical Recommendations
- **Immediate Action:** Review the list of third-party platforms used by field officers. If a DPIA is not on file, suspend use immediately.
- **Shift Culture:** Move away from "Soft Controls" (reminders) to "Hard Controls" (technical blocks) for high-risk data environments.
- **Transparency:** Ensure any data sharing with private retailers is governed by a signed, legally reviewed Data Sharing Agreement.