ICO reprimands Met Police over unlawful data sharing
- Details
The Metropolitan Police Service (MPS) has been reprimanded by the Information Commission (ICO) after officers and staff unlawfully shared personal information through an unapproved third-party platform used to identify suspected shoplifters.
The information watchdog also issued an enforcement notice requiring the force to strengthen its governance and oversight of third-party technologies used to process personal information.
Its investigation found that MPS officers and staff used the retail crime intelligence-sharing platform between March 2023 and September 2024, despite it not having been formally approved for use by the force.
Around 500 accounts were created on the platform, of which 375 were actively used for policing activities.
Between January and September 2024, personal information relating to 179 people, including three under the age of 18, was uploaded to the platform as part of efforts to identify suspected shoplifters. The information included names, dates of birth and, in a small number of cases, home addresses.
The ICO found the MPS had unlawfully processed personal information without individuals’ consent and where sharing was not necessary for law enforcement purposes.
It also found the force had failed to implement appropriate technical and organisational measures to protect personal information, follow assessment and approval processes for third-party technologies, and complete a data protection impact assessment before undertaking high-risk processing.
The regulator said the MPS continues to fail to implement appropriate measures to ensure that only approved third-party technologies were used to process personal information.
The ICO said that the MPS suspended use of the platform in September 2024 and reintroduced it in January 2026 after implementing a range of improvements and safeguards.
These included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment.
However, the watchdog concluded that regulatory action remained necessary to address wider governance concerns over the force’s use of third-party technologies.
The enforcement notice requires the MPS to strengthen its processes for identifying, assessing and approving third-party services used to process personal information.
It must also review its controls, improve governance processes, raise staff awareness and regularly test the effectiveness of its measures.
The force is required to provide periodic updates to the ICO on its implementation of the notice’s requirements.
David Doodson, the ICO’s head of investigations, said police forces held large volumes of sensitive personal information and needed robust safeguards to protect it.
He said: “Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities,
“Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.”
The MPS has been approached for comment.
Adam Carey
Jobs
Senior Legal Adviser (General Counsel Advice)
Directory
