Summary

  • MPS restored the platform in January 2026 after platform-specific safeguards, but the ICO still requires force-wide third-party technology controls.
  • A separate August ICO action concerned disclosure handling and training; the public record does not say MPS breached that earlier order.

The Information Commissioner’s Office (ICO) announced on 14 October that it had issued the Metropolitan Police Service (MPS) a reprimand and enforcement notice over officers’ use of an unapproved third-party retail-crime intelligence platform. The notice itself is dated 23 September, three weeks before the announcement. The case turns on a governance gap that survived the return of the service: platform-specific safeguards were added, but the regulator still wanted the force to prove that its wider technology approval controls worked.

MPS used the platform from March 2023 through September 2024, although it had not formally approved it. About 500 accounts were created and 375 were actively used for policing. From January to September 2024, records concerning 179 people were uploaded, including three people under 18. The data included names and dates of birth, and in a small number of cases home addresses. Those figures show the route had become operationally established; they do not mean every account uploaded data or that every person was charged.

The ICO says MPS suspended the platform in September 2024 and introduced stronger governance, staff training, formal contractual controls and a data protection impact assessment before bringing it back in January 2026. That remediation mattered, but it did not close the regulator’s broader concern: MPS continued to lack adequate measures to ensure staff used only approved third-party technology. The notice calls for stronger processes to identify, assess and approve external services, review of existing controls, better staff awareness, regular testing and periodic updates to the regulator.

The cited public record does not give a vendor name or a blanket ban.

The legal findings span three different control duties. Under the Data Protection Act 2018, the ICO identified an infringement of section 35(1), the law-enforcement principle requiring lawful and fair processing; section 40, which requires appropriate technical or organisational security measures; and section 64(1), which requires a prior impact assessment when processing is likely to create high risk. The announcement says the processing lacked consent and was not necessary for law-enforcement purposes, and that the DPIA had not been completed before high-risk processing. A contract or a later assessment cannot retrospectively supply the missing basis for earlier processing.

This was not the ICO’s only recent MPS intervention. In a separate August action, the regulator addressed an unredacted protection-order document and a bulk email that exposed sensitive information. It cited weak training compliance, monitoring and governance, and required work on different timeframes. The two cases involve distinct workflows; the public record does not say MPS breached the August order. Together they make cross-force assurance more relevant than a claim that one platform was fixed.

MPS has also made the operational case for retail-crime technology. In an August statement, it reported positive outcomes in 29.4% of shoplifting cases reported through new technology, compared with a prior force average of 7.3%. Those are the force’s own figures; the page does not establish a causal comparison or say whether that rollout is the same platform in the ICO notice. A London Assembly answer says the deployment of retail-crime reporting technology is an MPS operational decision, while the Mayor’s Office for Policing and Crime meets regularly with the force’s retail-crime lead. It does not describe the approval register or how those meetings test it.

The current regulatory question is practical: can MPS show, at the point staff gain access, that a service is approved, its purpose and lawful basis are set, high-risk processing has been assessed, and safeguards remain effective? The ICO’s action leaves the platform’s January return in place while shifting scrutiny toward the force-wide system that governs what staff can use.

Sources