ICO cautions ex worker for selling Princess medical records

A former healthcare worker at a private London hospital has been formally cautioned by the UK's data watchdog for attempting to sell the private medical records of Catherine, Princess of Wales. The Information Commissioner's Office announced the conclusion of its criminal investigation on Wednesday, June 17, 2026, stating the individual deliberately misused "highly sensitive personal information" and offered to disclose it for financial gain.

The incident relates to the princess's stay at the London Clinic in January 2024, where she underwent abdominal surgery. The ICO launched its investigation in March 2024 after the hospital reported a potential data breach. The watchdog stated that its probe found a now-former healthcare professional had committed an offence under the Data Protection Act 2018.

Following a full assessment, the ICO determined that issuing a formal caution was the appropriate and proportionate enforcement response, rather than pursuing criminal prosecution. The agency emphasized that the conduct represented a clear breach of trust. It also reviewed the hospital's procedures and stated that, based on the evidence, it did not identify any wider organisational...