ICO action against the Met: approve the use before the data flows

The brief

The ICO announced action against the Metropolitan Police Service on 14 October over use of an unapproved platform. Its enforcement record is dated 23 September. The findings concern law-enforcement processing under the Data Protection Act 2018, including assessment and governance failures. They should not be presented as a universal rule that every disclosure requires consent. ICO announcement. Enforcement record.

Our analysis is about the approval route before a new information flow begins. A team needs to know who may authorise the proposed purpose, the data involved and the people who will receive it. A tool’s availability does not answer those questions. Record the approved use and its limits so that a later change can be recognised and reviewed.

The full record

The ICO says the platform was used from March 2023 to September 2024, suspended and later reintroduced in January 2026 after improvements. It acknowledged remediation but required further work on technology governance. The enforcement record identifies sections 35(1), 40 and 64(1) of the Data Protection Act 2018. Read the ICO’s account. Read the legal scope in the enforcement record.

Our analysis: define what is being approved

A proposed system may be described as a better way to collaborate, yet that description does not identify the information flow. A useful approval request should explain the task, the information required, the people who need access and the proposed destination. It should also say what the system is not authorised to receive.

The responsible reviewers can then determine which legal and operational assessments are needed. Their decision should be attached to that defined use. Treating a general supplier approval as permission for any later purpose leaves the original decision difficult to interpret.

Make changes visible to the owner

Our suggested change record names the person proposing the change and explains what is different: a new recipient, a different dataset, a new purpose or a wider access group. Route it to the relevant owner before the expanded use begins. Keep the previous approval so that the boundary at each point in time remains intelligible.

If a team discovers an unapproved use, distinguish the facts already established from questions still under review. Preserve the relevant evidence within authorised arrangements. A later approval should carry its actual date and should not be presented as evidence that the earlier use had already been assessed.

Test the route with a fictional request

Ask a colleague to submit a realistic but fictional request for a new document-sharing use. Observe whether they can identify the owner, describe the information flow and obtain an attributable decision. If the process sends them between departments without a clear outcome, record that as a handover problem.

The proposed exercise does not decide whether any real processing is lawful. It tests whether the organisation can get the right question to the right reviewer before information moves. That is the practical communication lesson we draw from this enforcement account, with its specific police-processing context kept intact.

Read the ICO announcement and enforcement record on 19 October 2026. Announcement and decision dates are separated. The legal scope is Part 3 law-enforcement processing under the Data Protection Act 2018; no general consent rule is inferred. We did not inspect the police platform or independently assess remediation. Workflow proposals are editorial analysis.

1. ICO: Metropolitan Police Service governance action, 14 October 2026
2. ICO: Metropolitan Police Service enforcement record, 23 September 2026