英国信息专员办公室（ICO）对伦敦警察厅（MPS）进行了训诫，并发布了一份强制整改通知，此前警员在未经该警察厅批准或未进行必要的数据保护检查的情况下，使用了一个零售犯罪平台。在2023年3月至2024年9月期间，伦敦警察厅警员在Auror上注册了约500个免费账户，该平台是零售商用于记录入店行窃等犯罪行为的平台。该警察厅此前并未正式采购该服务，也未完成必要的数据保护检查。包括超市在内的零售商鼓励警员使用Auror，并将其引导至该平台以获取监控录像。
The Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service (MPS) and issued an enforcement notice after officers used a retail crime platform without the force's approval or required data protection checks. Between March 2023 and September 2024, MPS officersed around 500 free accounts on Auror, a platform retailers use to record crimes such as shoplifting. The force had not formally procured the service or completed the required data protection checks. Retailers such as supermarkets encouraged officers to use Auror and directed them to the platform to access CCTV footage.
注册于英格兰和威尔士的欧洲Auror公司是总部位于新西兰的Auror公司的子公司。该平台允许零售商共享事件报告、图像和监控录像。零售商通过浏览器或移动应用程序付费使用，而警方合作方则可免费使用。信息专员办公室表示，该警察厅并未完成数据保护影响评估（DPIA），也未与欧洲Auror公司建立数据共享协议。
Auror Europe,ed in England and Wales, is a subsidiary of New Zealand-based Auror. The platform allows retailers to share incident reports, images, and CCTV footage. Retailers pay for access through a browser or mobile app, while police partners use it free of charge. The force had not completed a data protection impact assessment (DPIA) or established data-sharing agreements with Auror Europe, the ICO says.
2024年8月至9月期间，提交了两份关于警员使用Auror的独立内部安全报告。第一份报告涉及警员上传了他们从监控录像中认出的嫌疑人姓名，第二份报告涉及警员从该平台收集监控录像，尽管未对其进行任何检查。截至2024年9月26日，对Auror的访问已被阻止。伦敦警察厅数据保护官（DPO）在2024年12月讨论一件独立事务期间，将该警察厅使用Auror的情况告知了信息专员办公室。该监管机构于2025年4月启动了正式调查。
Between August and September 2024, two separate internal security reports were filed regarding officers' use of Auror. The first related to officers uploading the names of suspects they recognized from CCTV footage, and the second pertained to officers collecting CCTV footage from the platform despite no checks being made on it. Access to Auror was blocked as of September 26, 2024. The MPS data protection officer (DPO) informed the ICO of the force's use of Auror in December 2024 during discussion about a separate matter. The watchdog launched a formal probe in April 2025.
信息专员办公室发现，警员非法向Auror上传了涉及179人的个人数据，其中包括3名儿童。对于128人，这些数据仅包含姓名；对于49人，包含姓名和出生日期；对于2人，包含姓名、出生日期和家庭地址。信息专员办公室表示，伦敦警察厅在决定允许警员使用哪些第三方平台时，未能确保实施充分的监督——这些失职情况至今仍然存在。
The ICO found that officers unlawfully uploaded personal data relating to 179 people, including three children, to Auror. For 128, this consisted of names alone; for 49, names and dates of birth; and for two, names, dates of birth, and home addresses. The ICO said the MPS failed to ensure adequate oversight was implemented when deciding what third-party platforms officers were allowed to use – failures that persist today.
该机构称，伦敦警察厅过度依赖政策提醒和员工培训等软性控制措施来防止警员使用未经批准的软件，而这些措施往往被忽视，而非采用技术拦截。信息专员办公室还表示，该警察厅未能测试其网络控制是否有效：警员使用Auror超过18个月而未触发警报。
It claimed the MPS is overly reliant on soft controls to prevent officers from using unapproved software, such as policy reminders and staff training, which often go unnoticed, rather than technical blocks. The ICO also said the force had failed to test whether its web controls worked: officers used Auror for more than 18 months without triggering an alert.
该监管机构描述了一起重复发生的失职事件，并指出警员在2021年未使用适当监督的情况下便使用了Clearview AI。信息专员办公室认为这些失职行为仍在持续，因为该警察厅尚未证明其保障措施能够防止类似事件发生。该执法行动迫使伦敦警察厅加强其针对不当使用第三方工具的防范保障措施，并向信息专员办公室定期提供进度更新。
The regulator described a repeat failure, pointing to officers' use of Clearview AI in 2021 without proper oversight. The ICO considers the failures ongoing because the force has not demonstrated that its safeguards can prevent similar incidents. The enforcement action compels the MPS to strengthen its safeguards against improper use of third-party tools and provide the ICO with periodic progress updates.
信息专员办公室调查主管大卫·杜德森（David Doodson）表示：“这一行动应向整个警务部门乃至更广泛的领域传递一个信息：如果您正在使用新技术来处理人们的信息，您必须从一开始就合法、透明地进行，并实施适当的治理。当组织未能保护人们的信息时，我们将采取行动。我们的职责不仅是追究组织的责任，更是推动改进并促进人们有权期望的标准。”
David Doodson, head of investigations at the ICO, said: "This action should send a message across the policing sector, and beyond: If you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset. "Where organisations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect."
伦敦警察厅向《The Register》表示，在实施更严格的控制措施和试点计划后，伦敦14个自治市镇的警员已再次开始使用Auror。
The MPS told The that following the implementation of stricter controls and a pilot scheme, officers in 14 London boroughs are once again using Auror.
伦敦警察厅发言人表示：“在获得正式批准和试点后，该平台目前已在伦敦14个自治市镇投入使用。它帮助警员更快地识别入店行窃者，使零售商能够在报告时直接分享证据和监控录像，并将入店行窃的积极结果增加了三倍。”
"Following formal approval and a pilot, the platform is now used in 14 London boroughs," a Met spokesperson said. "It helps officers identify shoplifters more quickly, enabling retailers to directly share evidence and CCTV at the point of reporting and has quadrupled positive outcomes for shoplifting."
在2026年8月的一份公告中，伦敦警察厅表示，这项未具名具体名称的技术将在14个自治市镇之外推广，并已在乐购（Tesco）、博姿（Boots）、格雷格斯（Greggs）和玛莎百货（M&S）等商店部署。该机构称，通过该平台报告的入店行窃事件中，有29.4%取得了积极的结果。
In an August 2026 announcement, the MPS said the tech, which it did not identify by name, would be rolled out beyond the 14 boroughs and was already deployed in stores such as Tesco, Boots, Greggs, and M&S. It said that instances of shoplifting reported via the platform result in a positive outcome in 29.4 percent of cases.
对于信息专员办公室的调查结果，该发言人表示：“我们接受信息专员办公室的调查结果，即我们当时的数据保护安排在个别警员使用Auror平台方面是不充分的。
Of the ICO's findings, the spokesperson said: "We accept the ICO's findings that our data protection arrangements at the time were insufficient in relation to individual officers using the Auror platform.
“虽然警员使用该平台是为了出于善意识别和逮捕入店行窃者，但我们承认，我们尚未完成该平台投入使用所需的相关安全和数据保护工作。
"While officers were using the platform in good faith to identify and arrest shoplifters, we recognise that we had not completed the relevant security and data protection work for the platform to be used.
“一旦我们意识到这个问题，我们立即暂停了对该平台的访问并进行了全面审查。我们在批准该平台使用之前，随后完成了必要的法律、安全、商业和数据保护检查。”
"As soon as we became aware of this issue, we immediately suspended access to the platform and carried out a full review. We have subsequently completed the necessary legal, security, commercial and data protection checks before approving the platform for use."
此次训诫和执法行动源于信息专员办公室在8月发出的另一份斥责，该斥责涉及两起敏感案件。在其中一起案件中，一名伦敦警察厅警员向一名反跟踪令的当事人发送了未作脱敏处理的法律文件，暴露了受害者的现住址和联系方式。在另一起案件中，一名警员犯下了将抄送（CC）当成密送（BCC）的低级错误，暴露了卷入一场“蜜罐”钓鱼陷阱的18名议会相关人员的电子邮箱地址。
This reprimand and enforcement action follow a separate rebuke from the ICO in August, concerning two sensitive cases. In one, a Met officer sent unredacted legal documents to the subject of a stalking protection order, exposing the victim's new home address and contact details. The other saw an officer commit the cardinal CC-not-BCC sin, exposing the email addresses of 18 people linked to Parliament who were targeted in a honeytrap sting. ®