Former healthcare worker cautioned over access to Princess of Wales' medical records

The Information Commissioner’s Office (ICO) has concluded its criminal investigation into a personal data breach reported by the London Clinic in March 2024. The inquiry focused on the unlawful procurement and unconsented disclosure of medical information to a third party, which newspaper reports indicate belonged to the Princess of Wales.

Following an assessment under the Code for Crown Prosecutors and its own prosecution policy, the ICO issued a formal caution to a now former healthcare professional from London. The individual was found to have committed an offence under section 170(5) of the Data Protection Act 2018, involving the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain. The regulator concluded that the caution was a proportionate enforcement response, given the evidence and the public interest.

The ICO also evaluated whether wider organisational deficiencies existed at the London Clinic. However, based on available evidence, it identified no systemic information security failings that met the threshold for regulatory enforcement. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.