Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Home / Critical Brief / No. 157
No. 157 Critical Brief · Verifiable Origin

Metropolitan Police: Officers put suspects' data on an outside platform wrongly said to be approved (UK ICO action)

Nothing checks at the point of use whether a platform is approved

179people
People (shoplifting suspects) whose personal data was uploaded to Auror, three of them under 18. Besides names, some entries included dates of birth or addresses
~500accounts
Accounts officers and staff created with Met email addresses, 375 of them actively used
2023-03→2024-09
How long Auror was used without Met approval (per the ICO announcement)
CountryUK
Incident date2024-08-29
Published2026-10-23
AuthorsLemma Critical Team
Contents
  1. 01TL;DR
  2. 02What happened
  3. 03Timeline — disclosure and response
  4. 04Why it wasn’t stopped
  5. 05How to counter this
  6. 06Sources

TL;DR

  1. 01What happened

    On October 14, 2026, the UK Information Commissioner’s Office (ICO) announced a reprimand and enforcement notice against the Metropolitan Police Service (MPS). From March 2023 to September 2024, officers and staff used Auror, a retail crime intelligence platform the Met had not approved, creating about 500 accounts. In 2024, personal data on 179 shoplifting suspects was uploaded, three of them under 18.

  2. 02How it spread

    Officers, encouraged by retailers, used QR codes sent by the operator to create their own accounts with Met email addresses. Some began after a former officer’s account of it. By the Met’s account, the site carried the Met’s logo and statements that the Met was a customer, and its URL filter classed the site as professional services and did not block it (per the ICO).

  3. 03The missing layer

    The Met noticed through internal reports and blocked access, but data on 179 people had already been uploaded. What failed was the layer that checks, at sign-up and at upload, whether an outside platform is approved.

What happened

The organisation
The Metropolitan Police Service (MPS). The ICO acted under Part 3 of the Data Protection Act 2018, which covers processing for law enforcement.
Auror’s status
The Met had not procured, approved or adopted Auror as an organisation, and there was no contract or information-sharing agreement (per the ICO). An approval board on June 27, 2023 reviewed only the mobile app and approved it with caveats, but the app was blocked by the Met’s own IT controls. The browser version officers actually used never went through any approval process (per the ICO).
The approval process
No one from the data protection team attended the board. The person requesting approval decided whether a DPIA was needed, wrote that it was not, and this was not challenged. The board took the former officer’s statement that the platform was already in use through a browser to mean it was approved, and did not check (per the ICO).
Accounts
About 500 between March 2023 and September 2024, 375 of them active. Because people registered individually, the Met had no central record of use. The first use the Met knows of is January 2024, but the ICO says use from March 2023 is “possible”.
What was uploaded
Officers identified suspects they recognised in retailers’ CCTV images and uploaded their details. Of the 179 people, 128 had names only, 49 names and dates of birth, and 2 also home addresses. A small number of entries referred to the use of facial recognition. 59 people were arrested, charged, convicted or circulated as wanted as a result of being identified on the platform (the Met’s internal analysis, cited by the ICO).
The ICO’s findings
Sharing dates of birth and addresses when names would have done was unnecessary, and so unlawful. There were no appropriate technical or organisational measures, and no DPIA before high-risk processing. Measures to make sure only approved technology is used are still lacking, so the ICO issued an enforcement notice (per the ICO).
Reporting and notification
No personal data breach report was submitted. The Met judged there was no high risk requiring notification to individuals (per the ICO).

Glossary
ICO — The UK Information Commissioner's Office, which oversees data protection.
Auror — A cloud platform where retailers log crimes such as shoplifting and share them with police. In the UK it is run by Auror Europe Limited, a subsidiary of New Zealand's Auror. Police accounts are free.
DPIA — A data protection impact assessment: evaluating risks and safeguards before introducing new processing of personal data. The law requires it for high-risk processing.
Reprimand and enforcement notice — A reprimand formally censures past breaches. An enforcement notice orders action, with deadlines, on failures that are still ongoing.

Exhibit 1The sequence, following the ICO notice

The stopping points are ② and ③. Had signing up with a work email and uploading personal data each been checked against whether the platform was approved, an unapproved platform would have been stopped.

Retailers / operator
1
Recommend Auror to officers and send sign-up QR codes

By the Met's account, the site carried its logo.

Officers / staff
2
Create their own accounts with Met email addresses

About 500. Wrongly told it was approved.

Officers / staff
3
Upload suspects' names and other details

179 people in 2024.

Met
4
An internal security incident is reported

August 29, 2024.

Met
5
Access is blocked

September 26, 2024.

Timeline — disclosure and response

  • Auror is made available to officers (exact date unknown). The ICO says use from this point is possible but not proven.
  • An approval board reviews the Auror mobile app. The data protection team is not present.
  • The first use the Met knows of. Per the ICO announcement, data on the 179 people was uploaded between January and September.
  • The first security incident report: an officer had uploaded the names of suspects they recognised.
  • A second report notes the platform “has not been approved” by cyber security, and access is blocked the same day.
  • Staff are told to stop using it.
  • The ICO learns of it while talking with the Met’s data protection officer about another matter.
  • The ICO opens a formal investigation.
  • The Met signs a formal contract with Auror.
  • Use resumes after a DPIA.
  • The ICO issues the reprimand and enforcement notice.
  • The ICO publishes it.

The facts rest on the ICO’s reprimand and enforcement notice (47 pages) and its announcement (both primary). The announcement ends the account and upload periods in September; parts of the notice say October. We could not find statements from the Met or Auror on the action. The notice does not say whether the uploaded data was deleted on Auror’s side.

After disclosure

  • The Met: Accepted the provisional findings, including that governance at the time was insufficient. It set up a Commander-led Gold Group, had Auror remove the Met’s logo (confirmed November 5, 2024) and asked Auror for the shared data. It found no retailer had used the data to ban anyone, take civil action or share it further (per the ICO).
  • Use since reinstatement: Officers can only view; they cannot upload or enter free text. Training is required first, and the Met can audit use (per the ICO).
  • What the enforcement notice requires: Within three months (then at least annually), identify unapproved outside platforms in use and review and revise the approval process. Within six months, assess and approve each one or block it technically, set standard controls for sharing with third parties, and review training. Within twelve months, test that the measures work. The Met must send the ICO periodic updates (per the ICO).

Why it wasn’t stopped

This case was not about missing policy. Whether the outside platform was approved was asked neither when accounts were created nor when personal data was uploaded.

The core of this case
Being able to sign up with a work email did not mean the organisation had approved the platform. That difference was asked neither when accounts were created nor when data was uploaded.
Exhibit 2The detection–proof gap

Proof here means checking, before signing up to an outside platform and uploading personal data, "is this platform approved by the organisation?", and recording it. Detection means noticing through internal reports after the data is uploaded.

Proof layer · absentBefore use, check the platform is approved
The gapData on 179 people
uploaded
Detection layer · noticedAn internal report leads to a block
STEP 1
Accounts created
STEP 2
Personal data uploaded
STEP 3
08-29 incident report
STEP 4
09-26 blocked

Internal reporting worked and the Met blocked access, but it noticed after data was uploaded, and blocking took about another month (the ICO said no explanation was given). “Could sign up with a Met email” and “is a platform the Met approved” are separate facts, and the ICO notice shows no layer checking the first against the second. That distance is the detection–proof gap, and it is a structural one.

The same structure appears in Awa Bank (an environment still holding customer data stayed in other use without anyone re-confirming it should).

How to counter this

When staff sign up to an outside platform, and when they upload personal data to it, check that the platform is approved by the organisation. Then a handy outside service can spread on the front line without data going to an unapproved platform. This is not a substitute for detection; it sits in front of it.

Industries and operations to watch

IndustryGovernment & public sector
Police forces and local governments where staff readily start using handy outside services. The ICO called it a repeat of the type of incident behind its December 2021 reprimand of the Met over Clearview AI facial recognition.
IndustryServices & retail
Retailers that share crime intelligence with police and government, and the companies running the sharing platforms. Here the operator sent officers sign-up QR codes.
OperationDisclosure & data release
Uploading personal data to outside platforms. The ICO found sharing dates of birth and addresses, when names would have done, unlawful.
OperationApproval & sign-off
Approving new tools. Only the requester decided whether a DPIA was needed, and data protection staff were absent from the board.

Do today’s controls close it?

ControlThis caseWhy
PolicyPartialThe ICO said the policy itself was appropriate, but it was not backed by technical measures or training.
URL filterIneffectiveBy the Met’s account, the site was classed as professional services and was not stopped.
Approval boardPartialIt reviewed only the mobile app; the browser version used never went through the process.
Internal incident reportsPartialThey noticed after uploads, and blocking took about a month.
ControlsWhat is needed
  1. Limit outside sign-ups with work email to approved services. Do not let sign-ups to services off the approved list go through on an individual’s judgement.
  2. Before personal data goes to an outside platform, check that the platform is approved and that each field is needed for the purpose. Here the ICO judged dates of birth and addresses were not needed.
  3. Keep, on the organisation’s side, what went to which platform under which approval. Here individual sign-ups left no record, and even when use began could not be confirmed. Keep it in a form that can be checked later: in other words, as proof.
CheckChecklist

Three things to confirm in your organisation about outside services

  • Can anyone create accounts on outside services with an organisation email address?
  • When approving a new tool, does only the requester decide whether an impact assessment is needed?
  • Can you technically block traffic to services you have not approved?

Note: misuse inside an approved platform, or uploading fields that are not needed, is not stopped by this check alone. Use from personal devices or personal accounts bypasses the organisation’s check.

Sources

  1. Primary, reprimand and enforcement noticeICO “Metropolitan Police Service – Reprimand and Enforcement Notice”2026-09-23 · ico.org.uk/media2/…
  2. Primary, announcementICO “ICO takes action against Metropolitan Police Service”2026-10-14 · ico.org.uk/about-the-ico/…
  3. Primary, enforcement listingICO “Metropolitan Police Service” (reprimand and enforcement notice, 2026-09)ico.org.uk/action-weve-taken/…
  4. Primary, operator announcement, backgroundAuror “Auror rolls out across London to take on repeat offenders and organised retail crime”2026-04-28 · auror.co/media-center/…

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 4 "Human error" cases Get new cases and checks like these by email

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"Metropolitan Police: Officers put suspects' data on an outside platform wrongly said to be approved (UK ICO action) — Nothing checks at the point of use whether a platform is approved".
Lemma Critical Brief No.157. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/157-met-police-auror-unapproved-platform/
Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma attaches cryptographic proofs to data and AI execution, so the receiving side can confirm authenticity without asking the issuer. Detection stays; a proof layer is added in front of it.

Talk to enterprise See the verification center