The Information Commission’s Office (ICO) has issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) after finding that its officers and staff shared personal information using an unapproved third-party retail crime intelligence-sharing platform without appropriate data protection safeguards, governance or oversight.

The ICO’s investigation found that MPS officers and staff used the platform between March 2023 and September 2024, despite it not being formally approved for use by the force. Around 500 accounts were created, with 375 actively used for policing activities. The investigation found that between January and September 2024 personal information relating to 179 people, three of whom were under the age of 18, was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting. This included names, dates of birth and, in a small number of cases, home addresses.

The ICO found the MPS:

• unlawfully processed personal information without the individual’s consent and where sharing was not necessary for law enforcement purposes;

• failed to implement appropriate technical and organisational measures to protect personal information and ensure that assessment and approval processes for third-party technologies were followed;

• failed to complete a data protection impact assessment before undertaking high-risk processing; and

• continues to fail to implement appropriate measures to ensure that only approved third-party technologies are used to process personal information.

David Doodson, ICO Head of Investigations said: “Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it.

“Whilst new technologies can deliver significant operational benefits, organisations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight.

“This action should send a message across the policing sector, and beyond: if you are using new technology to process people’s information you must do so lawfully, transparently and with appropriate governance from the outset.

“Where organisations fail to protect people’s information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect.”

Improvements implemented by MPS before reintroduction of platform

In reaching its findings, the ICO acknowledged the MPS suspended use of the platform in September 2024 and implemented a range of improvements and safeguards prior to reintroducing it in January 2026. These safeguards included stronger governance arrangements, additional staff training, formal contractual controls and the completion of a data protection impact assessment. However, the ICO concluded that regulatory action was still required to address wider governance concerns relating to the use of third-party technologies by the MPS.

The enforcement notice requires the force to strengthen its approach to identifying, assessing and approving third-party services used to process personal information. It must also review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of the measures it has in place. The MPS is required to provide periodic updates to the ICO on its implementation of the requirements set out in the enforcement notice.