UK regulator issues formal rebuke to Met Police over third‑party data breach

The Information Commissioner's Office (ICO) has issued a formal reprimand and an enforcement notice to the Metropolitan Police following a privacy breach tied to the Auror data‑analytics platform, the regulator announced on Monday.

The ICO’s action stems from findings that the police force failed to safeguard personal information processed through Auror, a third‑party system used for crime‑analysis and intelligence gathering. The regulator said the lapse exposed data to unauthorized access, breaching the UK’s data‑protection laws under the UK General Data Protection Regulation (UK‑GDPR) and the Data Protection Act 2018.

According to the ICO, the Metropolitan Police did not carry out adequate due‑diligence on the security controls of the Auror platform before integrating it into their operational workflow. Moreover, the force did not have sufficient contractual safeguards or monitoring mechanisms in place to ensure that the vendor complied with required data‑security standards.

While the specific volume of data affected has not been disclosed, the regulator highlighted that the breach involved information that could include names, addresses, and other identifiers linked to individuals under police investigation. Such exposure raises concerns about the potential misuse of sensitive data, especially given the heightened public scrutiny of law‑enforcement surveillance tools.

The enforcement notice mandates that the Metropolitan Police take immediate remedial steps, including a comprehensive review of all third‑party contracts, implementation of stronger encryption and access‑control measures, and the submission of a detailed compliance plan to the ICO within 30 days. Failure to meet these obligations could result in further penalties, including fines.

Data‑privacy advocates have welcomed the ICO’s decisive response, noting that the case underscores a broader challenge for public sector bodies that increasingly rely on external technology providers. As digital tools become integral to policing, experts warn that robust oversight and clear accountability frameworks are essential to protect citizens’ rights while enabling effective law enforcement.

The Metropolitan Police has acknowledged the regulator’s findings and pledged to cooperate fully with the ICO’s remedial process. In a brief statement, the force said it is “committed to upholding the highest standards of data protection” and will “work swiftly to address the issues identified.” The situation is likely to prompt a review of other law‑enforcement contracts that involve third‑party data handling, as agencies seek to avoid similar regulatory actions in the future.