A former member of staff at the London Clinic has received a formal caution from the Information Commissioner’s Office following the deliberate misuse of the Princess of Wales’s private medical records.
The individual, who previously worked as a healthcare professional at the central London private hospital, attempted to sell the sensitive information for financial gain.
The ICO launched its criminal investigation in March 2024 after the London Clinic reported a data breach.
Reports at the time indicated that at least one staff member had attempted to access Catherine’s medical notes during her stay at the hospital in January that year.
A former member of staff at the London Clinic has received a formal caution from the Information Commissioner’s Office following the deliberate misuse of the Princess of Wales’s private medical records.
|
GETTY
The regulator confirmed the caution was issued for an offence under section 170(5) of the Data Protection Act 2018.
The ICO stated that its assessment followed the Code for Crown Prosecutors and the regulator’s own prosecution policy before determining the formal caution was warranted.
“The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust,” the ICO said on Wednesday.
The watchdog described the caution as “the appropriate and proportionate enforcement response” in this case.
A staff member attempted to access Catherine’s medical notes during January 2024.
|
GETTY
Investigators also examined whether broader organisational failings existed within the healthcare setting.
However, the ICO concluded that the available evidence did not reveal any shortcomings that would warrant regulatory action against the hospital itself.
The regulator emphasised it would not hesitate to pursue criminal prosecution where circumstances demanded such action.
Ian Hulme, the ICO’s executive director for regulatory supervision, stressed the importance of protecting patient data. “People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation.
“When this trust is broken, it’s right that the law allows us to take action,” he said.
Investigators also examined whether broader organisational failings existed within the healthcare setting.
|
GETTY
He added: “We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so.”
A spokesperson for the London Clinic expressed satisfaction that the matter had been resolved.
They said: “We all take considerable pride in delivering the very highest standards of care and discretion for every patient at The London Clinic.
“We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital.”