The UK's Information Commissioner's Office (ICO) has reprimanded the Metropolitan Police Service (MPS) over serious data protection failures involving unauthorised third-party technology. The incident highlights how shadow IT can compromise sensitive personal information, even within law enforcement agencies responsible for public security.
Investigations revealed that police officers and staff used Auror, a retail crime intelligence platform, without formal organisational approval. The system enables retailers and law enforcement to exchange information about suspected shoplifting incidents, including CCTV footage and identifying details.
Between March 2023 and September 2024, approximately 500 police accounts were created, with 375 actively used. Personal information relating to 179 individuals, including three minors, was uploaded, exposing weaknesses in data governance and oversight.
The watchdog found that sensitive information, including names, birth dates and some residential addresses, had been processed without adequate safeguards. Crucially, the police failed to conduct the required Data Protection Impact Assessment before introducing high-risk processing activities.
The ICO also identified recurring governance failures despite earlier concerns involving unauthorised facial recognition technology. Although the Metropolitan Police subsequently formalised Auror's deployment and introduced additional safeguards, regulators concluded that broader weaknesses remained unresolved.
The incident raises an important question for organisations adopting AI-powered applications, cloud platforms and third-party digital services. Employees increasingly bypass approved IT systems for convenience, creating invisible data exposure. Without continuous monitoring, access controls, vendor assessments and employee training, shadow IT can undermine cybersecurity investments.
For Indian enterprises, banks and government agencies, the warning is significant. As organisations prepare for compliance with India's Digital Personal Data Protection Act, discovering unauthorised applications, mapping personal data flows and enforcing third-party governance must become priorities. The lesson is clear: cybersecurity cannot depend exclusively on perimeter protection. Continuous visibility, accountability and privacy-by-design controls are essential to prevent sensitive information from escaping organisational oversight.
