A LinkedIn Celebration, Six Months Before an Enforcement Notice
In April, Auror’s co-founder and the Metropolitan Police’s official account posted on LinkedIn about a retail crime pilot going well. Officers in Lewisham and central London could review CCTV and incident reports submitted by retailers through a platform called Auror, and the positive outcome rate — arrests, charges, convictions — was running around 50% higher than the Met’s average. The comments were warm: “fantastic to see,” “about bloody time,” a named inspector thanked for leading the retailer engagement.
Last week, the Information Commission — the regulator formerly known as the ICO — published a reprimand and enforcement notice against the Met over that same platform. Its finding, in plain terms: officers had been using Auror for the best part of two years without it ever going through a proper data protection process, and nobody in a position to stop that had been watching closely enough. Six months separate the two posts: one celebrating the partnership, the other calling it unlawful.
What the Regulator Actually Found
Auror went live for Met officers in March 2023, after retailers started sending round QR codes encouraging staff to sign up directly. A request to formally approve the mobile app was considered that June, but the meeting had no data protection representative present and no impact assessment was done. The force’s own IT security then blocked the app — and officers kept using it anyway, by word of mouth and the same QR-code route.
Two internal security incident reports, in August and September 2024, caught what was actually happening: officers uploading suspects’ full names, dates of birth and addresses pulled from retailers’ CCTV, including details on three people under 18. The Met suspended access in October 2024. It then signed a formal contract with Auror in December 2025 and switched the platform back on in January 2026, with tighter restrictions.
The Information Commission’s reprimand lists four separate failings: unlawful processing without a proper legal basis; no assessment or approval of the third-party technology before it was used; no data protection impact assessment ahead of high-risk processing; and — this is the pointed one — the force “failed, and continues to fail” to stop staff using unapproved tools. Six named retailers, including Tesco, Boots, M&S, Greggs, Holland & Barrett and Home Bargains, had been feeding data into a system operating outside the Met’s own control the whole time.
The Questions Were Already There, in the Comments
What makes this one sting is that the right questions were asked in public, underneath the original celebratory post, and simply went nowhere.
One commenter, a business improvement consultant, asked a single plain question under a retail security leader’s post: “why software are you using to share it?” The reply: “I’m sorry, I don’t understand your question.” Nobody returned to it.
Further down the thread, a former Met detective chief inspector asked the question that actually mattered for scale: if this works well across a couple of London boroughs, “how does the Met ensure an England and Wales rollout to the other 42 forces?” That went unanswered too, sitting among three dozen congratulatory replies.
Eighteen months on, the regulator’s reprimand reads like a direct answer to both questions. The software wasn’t properly governed. And the rollout — now live across 14 London boroughs with eight more planned — had scaled a long way past the point where anyone had confirmed it was compliant.
A Regulator That Rebranded, Then Actually Did Something
The ICO became the Information Commission on 30 September this year, part of a restructuring under new data protection legislation. My honest assumption going into that change was that it would mean more structure and a new letterhead, not more enforcement — regulators that rename themselves don’t always follow through with teeth.
Two and a half weeks later, this reprimand and enforcement notice landed, and it isn’t a gentle word of caution. It names specific failures, references a near-identical 2021 reprimand over Clearview AI that evidently taught the Met nothing, and requires the force to actually fix how it vets third-party technology, not just promise to try harder. For a regulator I’d quietly written off as more process than consequence, that’s worth noting — and worth watching to see if it holds.
The Test Isn’t the Outcome. It’s Whether You Can Produce the Paperwork.
Most organisations have at least one piece of technology running right now that somebody adopted because it worked, word spread, and nobody ever circled back to get it properly signed off. It rarely starts as a decision. It starts as a QR code, a trial account, a “just try this, it’s useful” — and six months later it’s embedded in how a team operates.
Good early outcomes don’t tell you anything about whether that’s safe. They’re exactly how unauthorised technology survives long enough to become a habit — nobody questions what’s visibly working. The only test that matters is a boring one: if a regulator, a client, or your own board asked for the data protection impact assessment tomorrow, could you produce it? Could you name who approved the tool, when, and on what basis?
The Met couldn’t answer that for Auror. For eighteen months, nobody was meant to be able to. That’s not a technology failure. It’s a governance one — and it’s sitting in most organisations somewhere nobody’s looked yet.
