The UK's data protection regulator has issued a reprimand and an enforcement notice to the Metropolitan Police Service. The ICO Met Police Auror reprimand follows privacy failings linked to Auror, a platform used in retail crime reporting. It is a formal rebuke to the country's largest police force, and it raises a question that applies well beyond London: what happens to personal data once it leaves a police system and passes through a third-party tool?
This post covers what has been reported, why third-party platforms are a recurring weak point, and how you can find out what public bodies hold about you.
What the ICO found in the Met and Auror case
According to Infosecurity Magazine, the Information Commissioner's Office (ICO) has handed the Met both a reprimand and an enforcement notice over privacy failings connected to the Auror platform. The ICO's own announcement describes the action as relating to information governance failures at the force.
The two measures are different. A reprimand is a formal censure that records the regulator's findings. An enforcement notice goes further: it is a legally binding instruction requiring the organisation to take specified steps to fix the problems. Failing to comply with one can lead to further regulatory action.
The short summary available so far does not set out every detail of the failings, and we have avoided guessing at them. Readers who want the full findings should look to the ICO's published reprimand and enforcement notice for the exact breaches, the legal provisions cited and the corrective steps the Met must take.
How third-party platforms put police-held data at risk
Auror's own publicity says the platform has been rolled out across London to help tackle repeat offenders and organised retail crime. Tools like this sit between private organisations, such as retailers, and police. That is useful for joining up reports, but it also creates a chain of custody that is harder to control.
When personal data moves through a third-party system, several things can go wrong:
- Unclear responsibility. If a retailer, a vendor and a police force all touch the same record, it can be hard to say who decides how it is used, shared or deleted.
- Wider access than intended. Staff or users who should not see certain information may be able to reach it if permissions are loosely set.
- Weak oversight of vendors. An organisation remains accountable for personal data even when a supplier handles it.
This is not unique to policing. The same pattern of concentrated data and wide exposure is visible in the UK Biobank hack, where data on 500,000 volunteers was put up for sale. The common thread is that centralised data is only as safe as the weakest connection into it.
What the enforcement notice means for your data rights
Police forces process personal data under a specific part of the Data Protection Act 2018, which covers law enforcement processing. It carries obligations around security, accuracy and limiting who can see data. An enforcement notice signals that the regulator believes those obligations were not met and wants verified changes, not just an apology.
For individuals, the practical meaning is twofold. First, regulators do hold public bodies to account, even if the outcome here is a reprimand and a notice rather than a fine. Second, you do not have to wait for a regulator to act. You have a right to ask what an organisation holds about you.
The ICO has been scrutinising police data handling on several fronts. Our coverage of the ICO's police facial recognition audits shows the same theme: powerful tools are being adopted quickly, and oversight is catching up. For a look at how costly and uncertain those tools can be in practice, see our report on the British Transport Police facial recognition pilot.
How to file a subject access request with a public body
A subject access request (SAR) is a request to see the personal data an organisation holds about you. Making one is free in most cases and does not require a lawyer.
- Find the right contact. Most police forces and public bodies have a data protection or information rights team. Their website usually lists a SAR form or email address.
- Be specific. Say who you are, include proof of identity, and describe the records you want, such as reports, incident logs or correspondence, with approximate dates.
- Ask about sharing. You can also ask who your data has been shared with, which may reveal third-party platforms involved.
- Keep a record. Note the date you sent the request. Organisations generally have one month to respond, though this can be extended for complex requests.
- Expect some limits. Police may withhold information if releasing it would prejudice an investigation or other policing purposes. They should still tell you whether they hold data where they can.
- Escalate if needed. If you get no reply or an unsatisfactory one, you can complain to the ICO.
What This Means For You
The ICO Met Police Auror reprimand is a reminder that data handed to the police does not stay in one place. If you have reported a crime, been a witness, or been named in a report, your details may pass through systems run by outside suppliers. The regulator's action suggests that safeguards around those systems deserve closer attention.
You cannot control how a force configures its tools, but you can ask questions and exercise your rights.
Takeaways
- Read the ICO's published reprimand and enforcement notice for the full detail of the Met's failings.
- Remember that a reprimand records findings, while an enforcement notice is legally binding.
- Submit a subject access request to your local police force or any public body you suspect holds data on you, and ask who it has been shared with.
- Keep copies of your request and any response, and complain to the ICO if you are not satisfied.
- For wider context on how regulators scrutinise police data handling, read our piece on the ICO's police facial recognition audits.
The ICO Met Police Auror reprimand is one case, but the right it points to is available to everyone. A single subject access request is the simplest way to find out what is held about you.
