A former healthcare employee has been cautioned after attempting to access and sell the private medical records of Catherine, Princess of Wales, following an investigation by the UK’s Information Commissioner’s Office (ICO).
The ICO launched a criminal investigation in March 2024 after receiving reports that a staff member at the London Clinic had tried to obtain the Princess’s medical information while she was receiving treatment for abdominal surgery earlier that year.
The data protection regulator concluded that the individual had deliberately misused highly sensitive personal information and attempted to disclose it for financial gain. However, officials said a formal caution was considered the most appropriate and proportionate response in the case.
The ICO also confirmed that its investigation uncovered no evidence of wider failings or regulatory breaches at the London Clinic.
Ian Hulme, Executive Director for Regulatory Supervision at the ICO, stressed the importance of maintaining trust within healthcare settings.
He said patients must feel confident that personal medical information shared with hospitals and clinics is secure and protected from exploitation, adding that regulators are prepared to take action when that trust is violated.
A spokesperson for the London Clinic welcomed the conclusion of the investigation, describing the incident as isolated and regrettable. The hospital stated that its cooperation with the ICO had helped bring the matter to a close and reiterated that no organisational failings had been identified.
The London Clinic, located near Regent’s Park in central London, is one of the UK’s largest private hospitals and has frequently treated members of the Royal Family.
The Princess of Wales underwent abdominal surgery at the hospital in January 2024 and temporarily stepped back from public engagements during her recovery. Two months later, she revealed that she had been undergoing cancer treatment.
At the beginning of 2025, the Princess announced that she was in remission and has since gradually resumed official duties and public appearances.
The case has once again highlighted concerns over patient confidentiality and the safeguarding of sensitive medical records within healthcare institutions across the UK.