UK Privacy Regulator Takes Action Against Metropolitan Police Over Unauthorized Data Sharing

Key Takeaways

• Regulatory Action Against Metropolitan Police: The UK's Information Commissioner's Office (ICO) issued a reprimand and enforcement notice over the force's use of an unapproved third-party retail crime intelligence-sharing platform.
• Personal Information Shared Unlawfully: Between January and September 2024, officers and staff uploaded information relating to 179 individuals, including three children, to the platform.
• Governance and Oversight Failures: The ICO identified inadequate data protection safeguards, failures in technology approval procedures and the absence of a data protection impact assessment before high-risk processing began.
• Improvements Deemed Insufficient: Although the Metropolitan Police suspended the platform in September 2024 and introduced safeguards before reinstating it in January 2026, the regulator identified continuing concerns about wider third-party technology governance.
• Further Compliance Measures Required: The force must strengthen its technology approval processes, review existing controls, improve staff awareness and provide periodic updates on its progress.

Deep Dive

Hundreds of Metropolitan Police officers and staff used an unapproved third-party platform to share personal information about suspected shoplifters, including children, over an 18-month period without adequate data protection safeguards or oversight, according to findings released by the UK's Information Commissioner's Office (ICO).

The regulator issued a reprimand and enforcement notice against the Metropolitan Police Service (MPS) after finding that personnel had used the retail crime intelligence-sharing platform between March 2023 and September 2024, despite its never having received formal approval from the force.

Approximately 500 accounts were created during that period, with 375 actively used for policing activities. Between January and September 2024, officers and staff uploaded personal information relating to 179 people, three of whom were under the age of 18. The records included names, dates of birth and, in a small number of cases, home addresses.

The ICO found that personal information had been processed unlawfully without individuals' consent and where sharing was not necessary for law enforcement purposes. It also identified failures in the force's technical and organizational safeguards, including its procedures for assessing and approving third-party technologies. The Metropolitan Police had not completed a data protection impact assessment before undertaking the high-risk processing.

The scale of the platform's use raised questions about the force's ability to enforce its own technology approval procedures. Hundreds of accounts had been established and used for police work without formal authorization, and the ICO found that appropriate measures were still not in place to ensure that personnel processed personal information only through approved third-party services.

The Metropolitan Police suspended use of the platform in September 2024 and subsequently introduced additional safeguards before bringing it back into service in January 2026. Those improvements included stronger governance arrangements, further staff training, formal contractual controls and a completed data protection impact assessment.

The regulator acknowledged the changes but concluded that they did not adequately address its wider concerns about the force's governance of third-party technologies. David Doodson, the ICO's head of investigations, said police forces had a responsibility to protect the substantial quantities of sensitive personal information they held.

"Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it," Doodson said.

"Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities."

He said organizations introducing new systems must assess the risks, establish appropriate safeguards and maintain effective oversight before using them to process personal information.

The enforcement notice requires the Metropolitan Police to strengthen its procedures for identifying, assessing and approving third-party services. It must also review its existing controls, improve governance processes, increase staff awareness and regularly test whether its safeguards are effective. The force will be required to provide the ICO with periodic updates on its implementation of those measures.

Although the Metropolitan Police had addressed several deficiencies associated with the retail crime platform before its reintroduction, the enforcement notice requires changes to the force's broader approach to third-party technology. The regulator's continuing concern is whether the Metropolitan Police has sufficient oversight of the external services its personnel use to process personal information, and whether its approval procedures are being followed.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey