Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK Information Commissioner’s Office (ICO) has reprimanded the Metropolitan Police Service (MPS) and issued an enforcement notice after officers and staff uploaded personal information to an unapproved third-party retail-crime intelligence-sharing platform. The ICO found failures in lawful processing, risk assessment, technical safeguards and oversight. Information on 179 people was uploaded between January and September 2024, including three people under 18.
What the ICO action concerns
The ICO announced the reprimand and enforcement notice on 14 October 2026. Its separate enforcement record dates the combined regulatory action to 23 September 2026 and identifies infringements of sections 35(1), 40 and 64(1) of the Data Protection Act 2018.
The case concerns the MPS’s use of a retail-crime intelligence-sharing service that had not been formally approved by the force. The primary ICO records describe it only as an unapproved third-party platform; they do not identify the vendor by name.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What information was uploaded
The MPS used the platform from March 2023 until September 2024. About 500 accounts were created, of which 375 were actively used for policing. During the period from January through September 2024, personnel uploaded information relating to 179 people while trying to identify suspected shoplifters.
#1 Best Overall
| Measure | ICO-reported figure or period |
|---|---|
| Accounts created | About 500 |
| Accounts actively used for policing | 375 |
| People whose information was uploaded | 179 |
| People under 18 | 3 |
| Platform use | March 2023–September 2024 |
| Uploads covered by the reported figures | January–September 2024 |
The records say the uploaded data included names and dates of birth. In a small number of cases, home addresses were also included. The affected individuals were people officers or staff were seeking to identify in connection with suspected shoplifting.
Why the ICO found the processing unlawful
No adequate lawful basis for the sharing
The ICO said the MPS processed personal information without individuals’ consent in circumstances where the sharing was not necessary for law-enforcement purposes. For policing bodies, the absence of consent does not automatically make processing unlawful; the processing must still satisfy the applicable Data Protection Act requirements and be necessary, proportionate and properly controlled. The ICO concluded those requirements were not met in this use of the service.
No data-protection impact assessment
The force had not completed a data-protection impact assessment before starting what the ICO considered high-risk processing. A DPIA is intended to identify foreseeable harms, test whether a proposed activity is necessary and proportionate, and specify safeguards before personal data is placed in a new system.
Weak approval and oversight controls
The MPS also failed to ensure that only approved third-party technologies were used. The ICO identified inadequate technical and organisational measures, insufficient governance and a lack of effective oversight over the platform and its users.
Rank #3
What happened after the platform was suspended
The MPS suspended use of the platform in September 2024. It reintroduced the service in January 2026 after adding stronger governance arrangements, staff training, formal contractual controls and a completed DPIA.
Those changes did not remove the need for regulatory action. The ICO said broader concerns about how the MPS governs third-party technologies justified the reprimand and enforcement notice. The notice therefore addresses the force’s wider control framework, not only the particular platform involved in this case.
Requirements in the enforcement notice
The notice requires the MPS to improve the way it manages any third-party service that processes personal information. The required work includes:
- identifying and assessing third-party services before they are used;
- formally approving services and documenting the decision;
- reviewing existing controls and improving governance;
- raising staff awareness through training and guidance;
- regularly testing whether safeguards operate effectively; and
- providing the ICO with periodic updates on implementation.
This approach places responsibility on the organisation that decides to use a technology service. A platform’s commercial availability or usefulness for investigations does not substitute for internal approval, a necessity assessment, contractual protections or continuing monitoring.
Best Value
What the case means for policing and other public bodies
The ICO’s action is a warning to organisations that adopt specialist or consumer-facing services outside established procurement and information-governance channels. The central issue was not simply that data appeared on a third-party system. It was that the MPS allowed an unapproved service to process personal information without the safeguards, accountability and documented risk analysis expected for high-risk policing activity.
David Doodson, the ICO’s Head of Investigations, said police forces hold large volumes of sensitive personal information and must maintain robust safeguards. He added that new technology can provide operational benefits, but innovation cannot outpace data-protection responsibilities: organisations must assess risks before introducing systems, put appropriate safeguards in place and maintain effective oversight.
The ICO said the action should send a message across policing and other sectors that technology used to process people’s information must be lawful, transparent and governed from the outset.
Was the vendor named?
No. The primary ICO announcement and enforcement record do not name the retail-crime intelligence-sharing platform’s vendor. Claims identifying a specific company should not be treated as established by this regulatory record.
Key dates
- March 2023: MPS use of the platform began.
- January–September 2024: Information relating to 179 people was uploaded, including data about three under-18s.
- September 2024: The MPS suspended use of the platform.
- January 2026: The MPS reintroduced it after adding governance, training, contractual controls and a DPIA.
- 23 September 2026: The ICO enforcement record dates the reprimand and enforcement action.
- 14 October 2026: The ICO publicly announced the action.
The Bottom Line
The ICO’s action against the Met concerns governance and lawful-processing failures around an unapproved third-party platform: 179 people’s information was uploaded, including data about three minors, and the force must now demonstrate stronger approval, risk-assessment, training and monitoring controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
