The UK's Information Commissioner's Office issued a reprimand and an enforcement notice to the Metropolitan Police Service over its use of the Auror retail crime intelligence-sharing platform between March 2023 and September 2024. The ICO found that officers and staff used the platform — which provides incident summaries, case management and an image-matching "Connect the Dots" module — without formal approval, with some 500 accounts created and 375 active. Between January and September 2024, personal information including names, dates of birth and home addresses relating to 179 people, three of them under 18, was uploaded to the unvetted platform, and two internal security incident reports had already flagged officer behaviour. The regulator found four infringements, including unlawful processing without consent, failure to apply appropriate technical and organisational measures, and failure to complete a data protection impact assessment before high-risk processing. It is a governance lesson for Australian and New Zealand agencies adopting third-party intelligence platforms: approval, privacy impact assessment and use-limitation controls must precede operational deployment, not follow it.

• Source article