A useful third-party tool can become an organizational privacy problem long before it becomes an officially approved system.
The UK’s ICO announced on October 14 that it had reprimanded the Metropolitan Police Service and issued an enforcement notice over an unapproved retail-crime intelligence platform.
The regulator found unlawful processing, inadequate safeguards and a missing data protection impact assessment. Information concerning 179 suspected shoplifters, including three children, was uploaded during January-September 2024.
These are regulatory findings. The notice was issued on September 23, rather than on the announcement date.
The issue extended beyond one platform
The force suspended use in September 2024 and introduced safeguards before restarting it in January 2026. The ICO acknowledged improvements but required further organization-wide controls for identifying, assessing and approving third-party technologies.
That distinction matters. Fixing an individual deployment does not necessarily resolve the process that allowed unapproved use to develop.
For privacy counsel, the wider question is whether the organization can identify other tools operating outside its approval framework.
A policy needs an operational route
An instruction to use only approved services must be supported by a workable way to obtain approval.
Staff need to know where to submit a tool, what information is required and who can decide. Reviewers need enough technical and contractual detail to understand the processing.
If the process is unclear or disconnected from operational needs, organizations may discover adoption only after personal information has already been shared.
That is a governance observation, not a finding about why individual officers used this platform.
Assess the activity, not just the supplier
A supplier’s capabilities do not establish the organization’s lawful basis for using them.
A meaningful assessment should examine the information involved, the purpose of sharing, access arrangements, retention, contractual responsibilities and risks to affected individuals.
Where children’s information is involved, the factual assessment should identify that clearly rather than treat all records as interchangeable.
Counsel also need to distinguish approval of a product from approval of every possible use of it.
Canadian relevance
The ICO action applies within the UK’s legal framework. It does not determine Canadian police information-sharing obligations.
Its practical lesson is relevant to organizations reviewing staff adoption of external platforms, including AI services: procurement, privacy, security and operational approval should connect before sensitive information enters the tool.
An inventory of approved suppliers is only useful if actual use can be checked against it.
The first governance question is whether the organization knows which tools its people are already using.
Related coverage: Sheppard Mullin Data Breach Lawsuit Highlights Social-Engineering Risk · Banking Regulators Ask Whether Autonomous AI Agents Can Be Controlled.
Sources: ICO announcement · ICO reprimand and enforcement record .