ICO reprimands Met Police for sharing data with unapproved third-party platform

The Information Commissioner's Office (ICO) has issued a formal reprimand and enforcement notice to the Metropolitan Police Service (MPS) for infringements of Sections 35(1), 40, and 64(1) of the Data Protection Act 2018 (DPA18).

The regulatory action follows an investigation revealing that MPS officers and staff used an unapproved third-party retail crime intelligence-sharing platform without adequate data protection safeguards, governance, or formal approval. The platform was operated between March 2023 and September 2024, during which approximately 500 accounts were established, with 375 actively used for policing functions.

The ICO found that between January and September 2024, the system uploaded personal details of 179 suspected shoplifters to support identification efforts. The exposed records included individuals' names, dates of birth, and, in a small number of instances, home addresses. Three of the individuals whose personal data were shared on the platform were under 18 years of age.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.