ICO Acts Against Metropolitan Police Over Unapproved Data Platform Use
ICO found Metropolitan Police uploaded 179 individuals' data without required privacy approval.
Why it matters: Law enforcement's use of third-party legal tech platforms carries significant data privacy risks. Ensuring proper compliance is critical for public trust and lawful case management.
- Between March 2023 and September 2024, MPS used a third-party retail crime platform without formal approval.
- Around 500 accounts were created on the platform; 375 were actively used for policing.
- Personal data of 179 individuals, including 3 minors, was uploaded without proper consent or necessity.
- ICO issued a reprimand and enforcement notice requiring improved data governance and compliance measures.
Between March 2023 and September 2024, the Metropolitan Police Service (MPS) used an unapproved third-party retail crime intelligence-sharing platform without following mandatory approval processes. As many as 500 accounts were created on this platform, with 375 actively used by officers and staff in policing activities.
From January to September 2024, the MPS uploaded personal information of 179 individuals, including three minors under 18 years old. This data included sensitive details such as names, dates of birth, and home addresses. The Information Commissioner's Office (ICO) determined the MPS unlawfully processed this information without individuals' consent and without demonstrable necessity for law enforcement purposes.
The ICO also found that the MPS failed to conduct a data protection impact assessment prior to high-risk data processing and lacked appropriate technical and organizational safeguards to protect personal data.
In response, the ICO issued a formal reprimand and an enforcement notice directing the MPS to strengthen how it identifies, assesses, and approves third-party services processing personal information.
The MPS suspended the platform's use in September 2024 and implemented improvements before reintroducing it in January 2026. These included enhanced governance frameworks, additional staff training, formal contractual controls, and completion of a data protection impact assessment.
David Doodson, ICO Head of Investigations, emphasized, "Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it." He added, "Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight."
By the numbers:
- 500 accounts created on unapproved platform — activity between March 2023 and September 2024
- 375 accounts used actively — for policing purposes during the same period
- 179 individuals' personal data uploaded — including 3 minors, between January and September 2024