Britain's privacy regulator has issued an official warning to a former employee of The London Clinic after she tried to obtain and sell sensitive medical information about Catherine, Princess of Wales, while the princess was hospitalized there for surgery. The case, first investigated in March 2024, ended this week with the Information Commissioner's Office concluding that the employee had deliberately misused highly sensitive data for financial gain.
According to the investigation, the woman used her access to hospital systems in an attempt to pull private medical records and offer them to the highest bidder. The regulator said a formal warning was the most appropriate and proportionate response because it was a one-off incident.
The London Clinic, a private hospital often used by members of the royal family, said it was pleased the matter had been closed. A spokesperson said no systemic failures or regulatory breaches were found at the hospital, calling it a "sad and isolated incident."
Ian Holman, head of enforcement at the Information Commissioner's Office, said patients must be able to trust that their personal information is protected from misuse. He said, "When that trust is broken, it is right that the law allows us to act." The breach drew concern in Britain because it came during a sensitive period for the princess, who had abdominal surgery in January 2024, stepped back from public duties, and revealed two months later that she had cancer. She has since returned to public life and recently attended the Order of the Garter ceremony after announcing she was in remission.
