ICO: about 500 Met accounts on Auror, 179 people uploaded, no DPIA, and a control gap it dates to May 2018

The notice dates the failure to 25 May 2018, and Auror is about 18 months of it

The ICO's combined reprimand and enforcement notice to the Metropolitan Police Service is dated 23 September 2026, and it runs on two clocks. The reprimand covers the Auror use, which the notice dates from March 2023 to 26 September 2024: about 18 months (derived; 17.9 to 18.9 months, because the notice gives no day for March). The enforcement notice covers something much older. The notice dates a failure to control officers' use of third-party platforms from 25 May 2018, the day the force's Part 3 duties under the Data Protection Act 2018 came into effect, and finds it still running on the notice date. That is 3,043 days (derived), about 8.3 years, and the Auror period is about 18 per cent of it (derived).

On top of those clocks sit the figures that travelled. About 500 Auror accounts were created by Met officers and staff, 375 of them active. Personal data on 179 identifiable people was uploaded: names alone for 128, names and dates of birth for 49, and names, dates of birth and home addresses for two. Three of the 179 were under 18. The notice also quotes the force's own data team saying that 59 of the 179 were "arrested, charged, convicted, or circulated as wanted" after being identified on the platform, and finds that no data protection impact assessment (DPIA) was done before or during the period. Every one of those counts comes from the Met's own letters and internal reviews, as the notice's footnotes show, and the notice describes no independent count.

What the record does not establish is most of what a reader would want to know next. It gives no split of the 59 into arrested, charged, convicted and circulated as wanted, and says nothing about the other 120 people (derived) or about anyone cleared. It does not say whether the retailers or Auror still hold a copy of the uploads. It does not decide who controlled the data once it sat on the platform, beyond finding that the Met controlled what its own officers did. It records no harm to any person, and says only that distress was "likely to have caused, or potentially could have caused". It does not say why there was no fine. And the sentence in the press coverage that officers used Auror for more than 18 months without triggering an alert is not in the visible text of the published notice, where paragraphs 80 to 82 are partly blacked out.

This briefing reads the ICO's notice (48 pages, read in full), its two listing pages for the reprimand and the enforcement notice, its news release of 14 October, the legislation the notice relies on and the ICO guidance it quotes. The Register's report of 15 October is read as secondary and set against the notice in the next section. The notice is dated 23 September; the ICO's news release is 21 days later (derived) and The Register's report 22 days later (derived), so the action was three weeks old when the headlines ran. The regulator was the Information Commissioner when the notice was signed under delegated authority, and became the Information Commission on 30 September 2026, as the notice's first footnote and the ICO's news release both explain. This briefing says ICO throughout. All sources were read on Thursday 15 October 2026 between about 08:43 and 09:12 BST.

The coverage against the notice, line by line

The Register's report is accurate on the headline facts and compresses several things the notice keeps apart. The table sets each coverage claim against the notice paragraph that supports it. Paragraph numbers are the notice's own.

Claims in The Register (15 October 2026) set against the ICO notice (23 September 2026). Paragraph numbers are the notice's. Reading column is this briefing's.

In the coverage	In the ICO notice	Reading
Reprimand and enforcement notice, reported on 15 October	One combined document dated 23 September 2026; ICO news release dated 14 October	Same action, 22 days old when reported (derived).
Around 500 free accounts	Para 24: approximately 500 accounts, 375 active. Para 17: law enforcement accounts are free of charge, retailers pay	Confirmed. Active is in the notice, not the report. Free describes the vendor's pricing.
March 2023 to September 2024	Paras 4, 24: March 2023 to 26 Sep 2024. Para 37: accounts created to October 2024. Para 40: uploads January to October 2024. News release: January to September	The notice and release disagree on the last month. An October upload would post-date the block.
Officers unlawfully uploaded 179 people's details	Paras 40, 58: 179 unique persons. Paras 68, 69 reason that dates of birth and home addresses were not necessary	People, not records. The reasoned unlawfulness rests on 51 people with a date of birth (derived). No separate reasoning is given for the 128 names-only uploads.
Retailers such as supermarkets encouraged officers	Para 20: retailers using the platform encouraged officers and directed them to it for CCTV review. No retailer is named	Such as supermarkets is not in the notice.
Used for more than 18 months without triggering an alert	Not in the visible text. Para 97 gives the Met's account that its filter classed the site as professional services. Paras 80 to 82 are partly redacted	Not confirmable from the published notice. March 2023 to 26 Sep 2024 is about 18 months (derived).
The Met's DPO told the ICO in December 2024	Para 28: the ICO became aware in December 2024 during talks with the DPO on a separate matter; the DPO told it of the officers' use on 17 February 2025	Compresses two steps. 52 days from that email to the formal investigation (derived).
The Met says it is now used in 14 boroughs after approval and a pilot	Paras 47 to 50: contract 11 December 2025, DPIA completed, platform re-enabled 26 January 2026	Consistent. The ICO says wider governance concerns still needed an enforcement notice.

Stated and not stated: what the notice fixes and what it leaves open

"Not stated" means not found in the published notice, the news release or the listing pages, read in full. It does not mean the information does not exist: the published PDF is redacted in places and says so only by black boxes.

What the ICO notice of 23 September 2026 states, and what it does not. Paragraph numbers are the notice's.

The question	Stated	Not stated
How many of the 179 were charged, convicted or cleared?	The Met's data team: 59 were arrested, charged, convicted or circulated as wanted after identification on the platform. Three of the 179 were under 18 (paras 40, 58)	The split of the 59. Anyone cleared or given no further action. Whether any outcome was challenged. Whether any of the three children is in the 59
What did the data include?	Names for 128, names and dates of birth for 49, names, dates of birth and home addresses for two. In a small number of cases a reference to facial recognition use. Officers' names, warrant numbers and email addresses were shared too (paras 40, 58, 59)	Free text content. Images or CCTV that officers uploaded. The number of uploads or records. Whether the data is special category: the Met's phrase is sensitive personal information (para 39)
Does anyone still hold a copy?	The Met asked Auror to remove its branding (confirmed 5 November 2024) and to provide the data uploaded. The Met's business crime team told the ICO no retailer used the data to ban anyone, take civil action or share it on (para 42)	Whether Auror supplied the data. Whether Auror or any retailer still holds the uploads. Deletion. Retention. The ICO's own check of the Met's claim
Who was controller of each flow?	The Met was controller of what its officers and staff processed on the platform (para 57). Auror says it is a data processor (its privacy page)	The role of Auror Europe Limited, of any retailer, or joint control of the sharing features. No finding is made against either
Was anyone harmed?	Distress was "likely to have caused, or potentially could have caused" (para 115). Risks listed: mistaken identification, being banned from premises, reputational damage (para 88)	Any identified harm, complaint, wrongful identification or claim
Why no fine?	A reprimand is "effective, proportionate and dissuasive" (para 110); the notice has regard to the Regulatory Action Policy (para 108)	Any mention of a penalty, whether one was considered, or whether the ICO's public sector approach was applied. The news release is also silent
Was the breach reported?	The Met's data team found a personal data breach; the Met says it was relayed to the ICO, but no breach report was ever submitted. The Met's assessment found no residual risks warranting referral (paras 39, 40)	Any finding on breach notification: sections 67 and 68 are not among the sections cited
When did use begin?	The Met's first known access is January 2024. A form of 9 June 2023 and a board paper of 27 June 2023 already described use. The ICO calls earlier use possible, "albeit not evidentially proven" (paras 35, 38)	The date. The number of logins. The Met has no audit trail: it says the trail resides with Auror (paras 24, 38)
Why was it open for 18 months?	The Met says its web filter classed the site as professional services and did not block it; the mobile app was blocked by existing controls (paras 36, 81, 97)	The technical reasons in the redacted paragraphs 80 to 82, and why the first report of 29 August 2024 took 28 days (derived) to become a block
Is it fixed?	Re-enabled 26 January 2026 after a contract and DPIA, view-only, no free text, training before access (paras 48, 49). The ICO says the Met has not shown its measures are effective and the governance failure is ongoing (paras 106, 107)	The DPIA's content. The contract's terms. Whether the Met appealed. The date the notice was sent

The dates, with the intervals worked out

Dates are as the notice gives them. The intervals are derived in calc.py and printed in calc-output.txt. The shortest is the one that matters most to a defender: from the first internal security report to the block took 28 days (derived).

Dated events in the ICO notice (paragraph numbers), with intervals derived by this briefing. Where the notice gives only a month, no day is assumed.

Date	What the notice records	Interval (derived)
25 May 2018	Part 3 obligations take effect; the Governance Infringement begins (paras 6, 55)	3,043 days before the notice
3 Dec 2021	Reprimand to the Met over officers' use of a facial recognition platform without corporate oversight (para 104)	571 days before the approval board
March 2023	Auror first available to officers; Auror period begins; no day given (para 4)	18 months to the block
9 Jun 2023	Request form for the mobile app says a DPIA is not required (paras 32, 33)
27 Jun 2023	Approval board: approve with caveats; no data protection representative present (paras 34, 35)	18 days after the form; 457 days to the block
Jan 2024	The Met's first known access; audit trail with the vendor (para 38)	269 days to the block from 1 January
29 Aug 2024	First security incident report: an officer uploaded suspects' full names (para 25)
26 Sep 2024	Second report; access blocked on Met systems (paras 26, 27)	28 days after the first report
Dec 2024 and 17 Feb 2025	The ICO becomes aware during talks about a separate matter; the Met's DPO then tells it of the officers' use (para 28)	52 days from that email to the investigation
10 Apr 2025	Formal ICO investigation opens (para 29)	196 days after the block; 531 days before the notice
11 Dec 2025 and 26 Jan 2026	Contract between the Met and Auror Europe; platform re-enabled for operational use after a DPIA (paras 48, 93)	487 days from the block to re-enabling
4 Aug 2026	The Met announces expansion to eight more boroughs (The Grocer)	3 days before the notice of intent
7 Aug 2026	ICO notice of intent and preliminary enforcement notice (para 9)
4 Sep 2026	The Met's written response accepts the provisional findings (paras 10, 109)	28 days after the notice of intent
23 Sep 2026	Reprimand and enforcement notice issued	727 days after the block
14 Oct 2026	ICO news release	21 days after the notice
15 Oct 2026	The Register's report	22 days after the notice; 749 days after the block

Two doors to one platform, and the control watched only one

The mechanism is in paragraphs 32 to 38 and 72 to 73 of the notice. A request form for the Auror mobile app went to the Met's mobile applications approval board in June 2023. The board approved the app with caveats. But existing IT security controls blocked the app's log-in, so it did not run. The platform's website, which does the same job in a browser, was never put to any board, risk assessed or approved. The notice records that the app was stopped by existing security controls while officers could still reach the platform through desktop browsers (paragraph 96): the control that worked sat on the door the board had looked at.

The board's own assessment recorded that the platform "was already in use", but only by web browser. The notice says the board accepted the requesting officer's statement about existing use and read it as meaning organisational approval, without checking (paragraph 77). The Met told the ICO that officer incorrectly told colleagues the platform was approved, and the notice adds that the form did not actually say it was approved (paragraph 33). The people whose job is to catch that, a representative of the Data Protection Team, were not at the meeting (paragraphs 34 and 75).

The enforcement notice is built to close that exact gap. Among other steps, Annex 1 orders: a review within three months, and at least annually, of third-party services that officers use without approval; within six months, either put each through assessment, approval, a DPIA and a contract, or block it by technical means; and within 12 months, a documented test of whether the controls work, including a sample check that new services get a DPIA before use. In the notice's words, reliance on "training and policies is insufficient" without technical measures (paragraph 112).

The friendly-name fallacy: eight labels that did the work of a control

A comforting label is not a control. Each of these words appears in the story, and each one stood in for a check that the notice says did not happen or does not mean what it sounds like.

Labels in the Auror story and what the ICO notice records behind each. Paragraph numbers are the notice's.

The label	What it suggests	What the record shows
Free accounts	No cost, so no procurement and no risk	Free to the officer; retailers are the paying customers. With no purchase there was no contract, no information sharing agreement and no force-side audit trail (paras 17, 23, 24)
A pilot	Someone is running a controlled trial	The Met's own review says the website was made available in 2023 "as part of a pilot" but never formally adopted. No owner, scope or DPIA is recorded (paras 19, 35)
Approve with caveats	The platform was approved	The board approved the mobile app only. The caveats were single sign-on and watching user numbers. The website was never reviewed (paras 35, 72)
Professional services	A site that is safe for work use	The Met says its filter put the website in that category and did not block it. A person blocked it by hand on 26 September 2024 (paras 81, 97)
Retail crime platform	A shop's reporting tool	Per the notice: incident recording and case management using a range of technologies including facial recognition, number plate recognition and AI, with modules that vary by contract (paras 17, 18)
Unapproved use	A handful of officers off the books	About 500 accounts, 375 active, and no audit trail. The Met calls it good faith. The ICO finds the policies appropriate but not followed (paras 24, 102, 103)
Reprimand	A telling-off with no teeth	A formal corrective power under Schedule 13 of the DPA 2018, with no fine and no tribunal appeal, open to judicial review. Here it is paired with a binding notice (paras 110, 119)
Enforcement notice	A warning letter	Binding steps at three, six and 12 months and a 28 day appeal window to the tribunal (Annexes 1 and 2). Not complying carries the higher maximum penalty (DPA 2018 section 157(4))

The Met, Auror and the retailers: who said what

The Met. The force accepted the findings. Its spokesperson told The Register that its arrangements "at the time were insufficient" and that officers were using the platform "in good faith"; the notice records the Met accepting the provisional findings in its response of 4 September 2026 (paragraph 109). The force says the platform is now used in 14 London boroughs after formal approval and a pilot. Its August announcement, as The Grocer reports it, puts positive outcomes for shoplifting reported through the platform at 29.4 per cent against 7.3 per cent before, a ratio of 4.03 (derived) that the Met calls quadrupled. The Grocer glosses a positive outcome as a caution, charge or other criminal disposal. That measure counts reports that retailers send through an approved route. It says nothing about the 59 people identified through officers' own uploads, and it is the Met's figure, not the ICO's. The announcement was on 4 August and the ICO's notice of intent is dated 7 August, three days later (derived).

Auror. Auror Europe Limited, the UK arm of a New Zealand company, is not a party to the notice and the notice makes no finding about it. What the notice records about Auror comes from the Met's letters: that Auror Europe sent QR codes so officers could create free law enforcement accounts (paragraph 20); that the site showed the force's logo and statements that the force was a customer until the force ordered them down, with removal confirmed on 5 November 2024 (paragraphs 42 and 81); and that a Met briefing said the platform "is promoted by Auror for its innovative technology" (paragraph 89). Those are the Met's statements to the regulator. Auror's reply to them is not in the notice. Auror's media centre listed no statement on the action when read on 15 October; its latest item was dated 29 September. Its published position, on its privacy page, is that it is a data processor that does not use customers' uploaded data for its own purposes. Auror is a commercial vendor whose retailers pay for access while police accounts are free, and its own network page says the network "grows stronger" with every new retailer and law enforcement agency.

The retailers. No retailer is named in the notice and no finding is made about any. The retailers named in coverage of the Met's August announcement have no stated role in the notice. The notice says retailers using the platform encouraged officers to use it and directed them to it for CCTV review (paragraph 20), and that officers who thought they recognised a suspect in an image shared identifying information with the retailer (paragraph 22). The Met's business crime team "ascertained" that no retailer used the data to ban anyone, take civil action or pass it on (paragraph 42). That is a statement to the regulator, not a finding. Retailers that subscribe have a commercial interest in faster police action on theft (inference).

Money, appeal and what the ICO can still do

No monetary penalty was issued. The ceiling was not low. Under section 157 of the DPA 2018, an infringement of section 35 or section 40, two of the three findings here, carries the higher maximum amount of 17.5 million pounds, and a failure to comply with an enforcement notice does too. Section 64, the DPIA duty, falls under the standard maximum of 8.7 million pounds. The ICO's law enforcement guidance on penalties says the same and adds that any penalty is decided case by case and meant to be effective, proportionate and dissuasive.

Neither the notice nor the news release says whether a penalty was considered. The notice says only that the ICO had regard to its Regulatory Action Policy and that a reprimand would be effective, proportionate and dissuasive (paragraphs 108 and 110). Separately, in a November 2025 blog the ICO described a public sector approach under which it prefers reprimands and enforcement notices and fines only the most egregious public sector breaches. Nothing published says that approach was applied here, so it is context, not an explanation.

An enforcement notice can be appealed to the First-tier Tribunal within 28 days of the date it was sent, and the date it was sent is not stated. If it was sent on 23 September, the last day is 21 October 2026, six days after this briefing's read date (derived, conditional). Under section 150 a requirement need not be complied with while an appeal is pending, and no compliance date may fall before the appeal period ends. The notice's first deadline is day 91 (derived). A reprimand has no appeal right and can be challenged only by judicial review (paragraph 119). Whether the Met has appealed is not stated, and the news release gives no sign that it has. The release also says the Met must give the ICO periodic updates; the published Annex 1 sets reviews at three, six and 12 months and annually after, but this briefing found no reporting schedule to the ICO in the visible text.

UK law: which regime governs which flow, and what the guidance says

Two regimes meet on one platform. When Met officers uploaded a suspect's name, the processing fell under Part 3 of the Data Protection Act 2018, the law enforcement regime, because the Commissioner of Police of the Metropolis is a competent authority listed in Schedule 7 and the purpose was the prevention, investigation, detection or prosecution of crime. When a retailer records an incident and uploads CCTV, the processing falls under the UK GDPR and Parts 1 and 2 of the same Act. The wording is similar. The rules and the tools are not.

Which regime governs which flow in the Auror story, from the DPA 2018 and UK GDPR as read on legislation.gov.uk on 15 October 2026 and the ICO guidance named. Roles not decided in the notice are marked as inference.

Flow	Regime and who is responsible	What the law and guidance say
Officer uploads a suspect's name, date of birth or address	Part 3, DPA 2018. The force is controller (notice, para 57)	[Section 35](https://www.legislation.gov.uk/ukpga/2018/12/section/35): lawful and fair, so based on law and either consent or necessary for a law enforcement task. [Section 40](https://www.legislation.gov.uk/ukpga/2018/12/section/40): security by technical or organisational measures. [Section 64](https://www.legislation.gov.uk/ukpga/2018/12/section/64): a DPIA before high-risk processing. [Section 71](https://www.legislation.gov.uk/ukpga/2018/12/section/71): the DPO advises on it.
Retailer records an incident and uploads images or CCTV	UK GDPR and DPA 2018 Parts 1 and 2. The retailer decides why it records, so it is a controller of its own records (inference)	An alleged offence is criminal offence data ([section 11(2)](https://www.legislation.gov.uk/ukpga/2018/12/section/11)). [Article 10](https://www.legislation.gov.uk/eur/2016/679/article/10) and Schedule 1 conditions apply. Article 6(1)(ea) recognised legitimate interest, crime ([Annex 1](https://www.legislation.gov.uk/eur/2016/679/annex/1), in force 5 February 2026), or legitimate interests. [Article 35](https://www.legislation.gov.uk/eur/2016/679/article/35): a DPIA for large scale offence data or new technology.
Retailer discloses CCTV or a report to police	UK GDPR for the discloser; Part 3 for the force that receives it	[Schedule 1 paragraph 10](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1): preventing or detecting unlawful acts. Paragraph 10(2) drops the appropriate policy document requirement for a disclosure to a competent authority. The ICO's [toolkit](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/can-i-share-personal-data-with-a-law-enforcement-authority/): sharing is lawful if necessary and proportionate. [Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6): points (ea) and (f) do not apply to a public authority performing its tasks.
Platform vendor hosts both sides' data	The vendor says it is a processor (its privacy page). The notice does not decide its role	[Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28): a contract, documented instructions and sufficient guarantees; paragraph 10 treats a processor that decides purposes and means as a controller for that processing.
Officer logs in and reads retailers' reports and CCTV	Part 3. The force is controller	The second security incident report (para 26) flagged officers collecting CCTV with no checks on the provider. The notice's findings cover processing "using the Auror Platform" and are not split by direction.

The DPIA duty is the clearest line the force crossed. Section 64(1) says that where a type of processing is likely to result in a high risk to individuals' rights and freedoms, the controller must carry out a DPIA "prior to the processing", and section 64(4) tells it to weigh nature, scope, context and purposes. The ICO's law enforcement DPIA guidance lists new technologies as a high-risk example and gives a police drone as its worked case: assess before purchase. The notice finds the Met's processing likely to be high risk because it disclosed suspects' data to retailers through an unapproved platform with innovative features, with risks of mistaken identification, being banned from premises and reputational damage (paragraph 88). A Met briefing is quoted admitting that no impact assessment had been completed (paragraph 89). Where a DPIA shows a high residual risk, section 65 requires consulting the regulator first, and the ICO guidance says processing cannot go ahead until then.

The guidance reads as plainly on the other points the notice uses. The ICO's principles guidance says necessary means "a targeted and proportionate way of achieving your purpose" and that the lawful basis does not apply if a less intrusive way would do. That is the test the notice applies to dates of birth and addresses, where the purpose "could reasonably have been achieved" by giving a name (paragraph 68). Its DPO guidance says the DPO must be independent, adequately resourced and report to the highest management level, and the notice treats the DPO's absence from the approval board as a failure of organisational measures (paragraph 76). For retailers, the ICO's high-risk list includes biometric data and data matching, and its criminal offence data guidance says suspicion and allegations count. Most of these ICO guidance pages carried a banner on 15 October saying they are under review following the Data (Use and Access) Act, and the principles page notes a 4 November 2025 update for the Act, so check for changes.

Questions each side should ask the other before sharing on a platform. Drawn from the notice, the ICO toolkit and the statutes above; the questions are this briefing's.

A retailer should ask the police contact	A police contact should ask the retailer
Which force and unit are you, and has your force approved and contracted this platform?	Who is the controller for this platform, and have you done a DPIA, including for any facial recognition or image matching?
Which law enforcement purpose and lawful basis does this request rest on?	What can your other users, and the vendor, see of what I view or enter?
What exactly do you need: a clip, a still, a name, an address? What is the least that meets the purpose?	Do you have recorded signage, a lawful basis and a retention rule for this footage?
Where will the footage go, who holds it, for how long, and where is my record of the disclosure?	Can you send the footage through the route my force has approved, not an account I opened myself?
Is there a data sharing agreement, and who is the other party's controller?	Will anything I tell you be used for banning notices or civil claims, and who else receives it?

Policing's own material points the right way but does not replace a force's own assessment. The College of Policing's practice bank carries a Devon and Cornwall Police entry on Auror, first published 14 October 2025 and labelled "Untested". It lists the stages in order: a DPIA and information security first, then single sign-on so the force controls who has access, then launch of the intelligence platform, then direct-to-police reporting. The Met's 2023 route skipped the first two stages. The entry is the force's own account, and the page says the views are the author's and not the College's. The NPCC's Retail Crime Action Plan of October 2023 names no platform. It says that "Due to constraints of GDPR" retailers lack the confidence to share information themselves, and asks them to send CCTV through a digital evidence management system. A plan that asks for CCTV does not say which tool a force may use; that stays with the force's DPO and its DPIA. The notice also records that after the 2021 Clearview reprimand the Met made the College of Policing's Managing Information course mandatory (paragraph 105), and orders the Met to use the National Policing Risk Ledger platform "or alternative appropriate means" to review its approval processes (Annex 1, paragraph 4). Risk Ledger is a commercial supplier assurance service that the Met told the ICO it now has access to; the notice does not require that product.

What to do, in order, for three roles

What this briefing could not verify

• Redacted text. Paragraphs 80 to 82 and parts of paragraphs 27 and 37 are blacked out in the published PDF. The Register's statement that officers used Auror for more than 18 months without triggering an alert is not in the visible text.
• The Met's own announcement. The Met's page for its 4 August 2026 announcement returned not found, so it is read through The Grocer's report only. The Met's full response to the notice of intent is known only as the notice quotes it.
• Auror's response. No Auror statement on the action was found on its media centre at the read time. No reply from Auror to the Met's statements to the ICO was found.
• The counts. The 500 accounts, 375 active accounts and 179 people come from the Met's letters and internal reviews. No independent count is described.
• The DPIA and the contract. Neither the Met's 2025 DPIA nor its contract with Auror Europe is published.
• The appeal. Whether the Met appealed, and the date the notice was sent, are not stated.
• The College of Policing page answered curl with a connection check, so it was read in an isolated browser page, with no challenge to pass. Its contact officer is not named here.
• The ICO's Regulatory Action Policy page was not read: its URL answered not found. The public sector approach is taken from the ICO's November 2025 blog only.
• Things that could change within the hour: an Auror or Met statement, a Tribunal appeal, a redaction change or new coverage. Read between 08:43 and 09:12 BST on 15 October 2026.

The question the Met's own record could not answer

The Met had good policies. The notice says so: the content of its policies "is appropriate" (paragraph 103). It also had an approval board, a DPO and a 2021 Clearview reprimand whose findings the notice calls "equally applicable". What the notice says it lacked was technical measures behind the policies (paragraph 112), so what finally stopped the platform was two incident reports and a manual block 28 days after the first (derived). The same question applies to every force, council and company reading this. If an officer or employee opened a free account on a supplier's website this morning and uploaded the first name, which technical control would stop it, who would be told, and when did anyone last test that it works?

Key facts