In January 2024, Catherine, Princess of Wales, was admitted to the London Clinic for abdominal surgery. Months later, a former healthcare worker at that hospital was formally cautioned by the UK’s data watchdog for trying to access her medical records and offering to sell them. The case has thrown a spotlight on the legal protections that safeguard patient information in Britain.
The incident was reported to the Information Commissioner’s Office (ICO) in March 2024, after the London Clinic – one of the UK’s largest private hospitals, frequently used by the royal family – detected that a staff member had attempted to view the princess’s notes. The ICO launched a criminal investigation. In June 2026, it issued a formal caution to a former healthcare professional for an offence under section 170(5) of the Data Protection Act 2018. The watchdog said the conduct involved “deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.” A caution, rather than prosecution, was deemed “the appropriate and proportionate enforcement response.” The ICO confirmed it found no wider organisational failings at the hospital.
“What the Kate Middleton medical records breach reveals about UK patient privacy law.”
Under UK law, medical records are classified as “special category data” and are subject to extra protections. The Data Protection Act 2018, which implements the EU’s GDPR (now retained UK GDPR), sets out strict rules for how personal data must be handled. Anyone who knowingly or recklessly obtains, discloses, or retains personal data without consent can face criminal sanctions. The ICO is the independent regulator that enforces these rules, and it can issue fines, prosecutions, or – as in this case – formal cautions. Ian Hulme, the ICO’s executive director for regulatory supervision, said: “People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action.”
For ordinary UK patients, the case underlines that medical confidentiality is legally enforced, not just a matter of professional ethics. Whether at an NHS trust or a private clinic, staff who abuse their access to patient data can face serious consequences. The incident also highlights that hospitals have systems to detect breaches: the London Clinic reported the matter to the ICO itself, and three employees were dismissed after an internal investigation, according to reports. The hospital’s CEO stated: “There is no place at our hospital for those who intentionally breach the trust of any of our patients or colleagues.”
The case raises several practical questions for patients. Here are the key ones:
Q: How can I find out if someone has accessed my medical records without permission?
Hospitals and GP surgeries in the UK are required to monitor access to patient records and report breaches to the ICO. If you suspect unauthorised access, you can raise a complaint with the healthcare provider or directly with the ICO, which has the power to investigate.
Q: What penalties can someone face for unlawfully accessing medical records?
Under the Data Protection Act 2018, the offence can lead to a criminal prosecution, a fine, or a formal caution. The ICO decides the response based on the severity of the breach and the public interest. In the princess’s case, a caution was issued because of the deliberate misuse and offer to sell the data.
Q: Are my medical records more at risk in a private hospital than the NHS?
All healthcare providers in the UK – public or private – must comply with the same data protection laws. The ICO’s investigation found no wider organisational issues at the London Clinic, suggesting the breach was an isolated act by an individual, not a systemic failure.
What happens next? The former healthcare worker now has a formal caution on record. A caution is not a criminal conviction but is a legal notice that can be used in future proceedings. The ICO has said it will not hesitate to pursue criminal prosecutions where necessary. For the public, the case serves as a reminder that patient privacy is a legally protected right – and that those who violate it can expect to face the consequences.