Met Police ICO Reprimand: A Governance Lesson for All Organisations Using Third-Party Platforms

The Information Commissioner's Office has issued a formal reprimand to the Metropolitan Police after officers unlawfully uploaded the personal details of 179 individuals to Auror, a commercial shoplifting intelligence platform, without completing the required data protection impact assessments or obtaining corporate approval. The Register reports that the force used the platform operationally before the necessary governance processes had been completed, in breach of its data protection obligations. The ICO found that the Met had failed to follow its own internal procedures before sharing personal data with an external commercial provider.

Why this matters for UK organisations

This case is a clear illustration of how data protection failures frequently arise not from cyberattacks or technical vulnerabilities, but from process gaps and the informal adoption of third-party tools without adequate oversight. The scenario — a team identifies a useful platform, begins using it operationally, and the formal privacy review and procurement process either lags behind or is bypassed entirely — is one that will be recognisable to many organisations across both the public and private sectors. Under UK GDPR, organisations are required to complete a Data Protection Impact Assessment before processing personal data in ways that are likely to result in high risk to individuals, and to ensure that any third-party data processor has appropriate contractual and technical safeguards in place. Failure to do so can result in regulatory action, reputational damage and, most importantly, real harm to the individuals whose data was shared without a lawful basis. The Met's case is a public-sector example, but the same risk exists wherever teams have the autonomy to adopt new tools quickly without a clear approval pathway.

What to review

Review whether your organisation has a clear, accessible process for teams to follow before sharing personal data with a third-party platform or SaaS tool, and whether that process is being followed in practice. Audit your current third-party data sharing arrangements to confirm that all active platforms handling personal data have completed data protection impact assessments and received appropriate sign-off. Consider whether your procurement and information governance processes are joined up, so that new tool adoption triggers the right privacy and security checks automatically. Ensure that staff who regularly handle personal data understand what approval is required before sharing it externally, and that this guidance is reinforced through training and clear internal communications.

Source: The Register