A former healthcare worker at a private hospital in London has been formally cautioned by the UK privacy and data watchdog over the deliberate misuse of the Princess of Wales’s private medical records and offering to disclose them for financial gain.

The Information Commissioner’s Office (ICO) launched a criminal investigation into the unlawful obtaining and disclosure of medical information to a third party without the consent of the data controller after the London Clinic reported a breach in March 2024.

At the time it was reported that at least one member of staff tried to access Catherine’s notes while she was a patient at the private hospital.

The London Clinic has treated the princess and King Charles in recent years. She spent almost two weeks at the private hospital after undergoing planned abdominal surgery for an undisclosed condition in January 2024. The following month she revealed that cancer was discovered in postoperative tests.

Reporting its findings, the privacy and data watchdog said: “Following a full assessment under the code for crown prosecutors and the ICO’s prosecution policy, the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018.

“The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.”

The ICO said a caution was “the appropriate and proportionate enforcement response”, adding: “We also considered whether there were any wider organisational issues arising from the healthcare provision in this matter. Based on the evidence available, we did not identify any failings that would meet the threshold for regulatory enforcement.”

Ian Hulme, the executive director for regulatory supervision at the ICO, said: “People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action.

“We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so.”

A London Clinic spokesperson said: “We all take considerable pride in delivering the very highest standards of care and discretion for every patient at the London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital.”