A former healthcare worker at the London Clinic has been formally cautioned after attempting to sell the Princess of Wales’s private medical records — a brazen breach of trust that triggered a criminal investigation by the UK privacy watchdog.
The Information Commissioner’s Office (ICO) launched the probe in March 2024 after the private hospital reported that a member of staff had tried to access Catherine’s notes while she was a patient there for abdominal surgery earlier that year. The princess spent almost two weeks at the clinic after undergoing planned surgery in January 2024; the following month she revealed that cancer had been discovered in postoperative tests.
“A former healthcare worker has been formally cautioned for attempting to sell the Princess of Wales's private medical records.”
The ICO said the former worker had committed an offence under section 170(5) of the Data Protection Act 2018, involving “the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.” A formal caution was deemed “the appropriate and proportionate enforcement response.”
Ian Hulme, the ICO’s executive director for regulatory supervision, said: “People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action.”
The watchdog added that its investigation had not found any evidence of “wider organisational issues arising from the healthcare provision in this matter.”
A London Clinic spokesperson said: “We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital.”
Catherine, who was seen smiling during the Order of the Garter service on Monday, has gradually returned to public duties since confirming she was in remission from cancer at the start of 2025.