Summary
- Around 500 platform accounts were created, with 375 actively used for policing.
- Information about 179 people, including three children, was uploaded during 2024.
- The ICO issued a reprimand and enforcement notice over governance and safeguards.
The Information Commissioner's Office has reprimanded the Metropolitan Police Service and issued an enforcement notice after finding that officers and staff used an unapproved retail crime intelligence-sharing platform for policing purposes. The regulator said approximately 500 accounts were created between March 2023 and September 2024, with 375 used actively in police work. Its intervention comprises a reprimand and a formal enforcement notice, rather than a financial penalty or a finding that police records were stolen by an external attacker.
Its investigation found that personal information relating to 179 people was uploaded between January and September 2024. Three of those individuals were under 18. Records included names, dates of birth and, in a smaller number of cases, home addresses. The platform was used in connection with attempts to identify people suspected of shoplifting, but the force had not formally approved it for that purpose.
The enforcement concerns unapproved information sharing and the absence of appropriate safeguards, not a reported compromise of the platform. The ICO identified shortcomings in data protection safeguards, governance, and oversight during the platform’s use. The finding followed a review of information shared between January and September 2024, a narrower period than the overall period in which officers held accounts. An accessible technology product can appear useful to operational teams while the legal authority, contractual arrangements and security review needed for the intended data have not been established.
Police information carries risks beyond an ordinary customer list. An inaccurate association with suspected offending can affect an individual's treatment, while retaining or distributing personal identifiers can expose information about people who have not been convicted of a crime. Children's records require particular care. The ICO's findings concern how the material was handled and governed, not a conclusion that each listed person had committed an offence.
An information-sharing platform can also blur the boundary between private-sector loss-prevention systems and state policing powers. Retail businesses may use technology to communicate suspected crime patterns, but police use introduces statutory responsibilities for accuracy, necessity, retention and accountability. Those duties cannot be transferred to a supplier merely by opening user accounts.
The number of accounts is evidence of how widely the unapproved tool was used within the organisation, although it is not a count of affected individuals or incidents. The 179 uploaded people's records are the personal-information population identified for the relevant period. These figures should not be conflated, and the finding does not establish that all account holders accessed every uploaded record.
The regulator's action places formal obligations on the Metropolitan Police to improve governance and safeguards. In large public bodies, controls need to reach individual teams adopting externally hosted services, including those that may appear peripheral to core information technology procurement. Access reviews, the legal basis for processing, supplier assurance and clear records of approval all contribute to that oversight, but the ICO's specific enforcement requirements remain the authoritative measure of compliance.
Lawful policing purposes do not automatically authorise every technical mechanism for sharing personal information. Even where an investigation has a legitimate policing objective, the service used to exchange records can introduce new recipients, retention arrangements and audit requirements. The ICO's findings describe a failure of institutional approval and oversight, not simply individual account security. That makes the response wider than resetting credentials or disabling a few user accounts. Governance has to establish what classes of data may be uploaded, who can see them, how long they remain available and how inappropriate or inaccurate records can be corrected or removed.
The Metropolitan Police's use of the tool ended in September 2024 according to the investigation period described by the regulator. The 14 October 2026 notice documents the consequences of that historic activity and the regulator's requirement for stronger information governance.
