A former healthcare worker at the London Clinic has been given a formal caution over the deliberate misuse of the private medical records of the Princess of Wales. The caution was issued by the Information Commissioner's Office, the United Kingdom's privacy and data protection watchdog. According to the watchdog, the worker had also offered to disclose the sensitive information for financial gain.
The case dates back to January 2024, when the Princess of Wales was admitted to the London Clinic, a private hospital, for abdominal surgery. Some months later, she announced that tests carried out after the operation had found cancer. She then underwent a course of chemotherapy before saying, in January 2025, that she was in remission.
While that treatment was taking place, an investigation was already under way into a data breach. In March 2024, it was alleged that attempts had been made to access the medical records belonging to the princess and then to sell them on. The allegation pointed to a serious breach involving some of the most sensitive personal information.
The Information Commissioner's Office has now confirmed the outcome of that inquiry. Following a full assessment under the Code for Crown Prosecutors and the ICO's own prosecution policy, the watchdog issued a formal caution to a now former healthcare professional in London. The caution relates to an offence under the Data Protection Act 2018.
According to the ICO, the conduct involved the deliberate misuse of highly sensitive personal information. The formal caution marks the conclusion of the case, with no further action being taken against the individual beyond that measure. The watchdog said it had weighed the evidence carefully before deciding on its response.
As for the London Clinic itself, no breach was found on the part of the hospital. In a statement, the clinic said it was pleased that its work with the Information Commissioner's Office had brought what it described as a sad and isolated incident to a conclusion. The case once again drew attention to the protection of patients' private records.