LONDON: A former London healthcare worker has been given a formal criminal caution, Britain’s data watchdog said on Wednesday, after Princess Catherine’s private medical records were offered for sale.

At least one ex-staff member at the private London Clinic hospital tried to access her medical notes while she was a patient there in January 2024, The Mirror tabloid has previously reported.

A health minister subsequently confirmed law enforcement were examining the allegation. The clinic reported the breach in March 2024 to the Information Commissioner’s Office (ICO), which can investigate and prosecute individuals and organisations for breaches of data protection and freedom of information laws.

It launched a criminal probe into “the unlawful obtaining and disclosure of medical information to a third party” without consent, which it said Wednesday had now concluded. “Following a full assessment … the ICO issued a now former healthcare professional from London with a formal caution,” it said in a statement, without naming the princess.

“The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.” Catherine — widely known as Kate and whose husband Prince William is heir to the throne — spent two weeks at the hospital in January 2024, when she underwent abdominal surgery.

She had been diagnosed with an undisclosed form of cancer early in 2024, for which she received chemotherapy treatment. The 44-year-old royal revealed she was in remission 16 months ago.

A spokesperson for the clinic in central London told the BBC it was “pleased our work with the ICO has brought this sad and isolated incident to a conclusion”. “There were no regulatory breaches by the hospital,” the spokesperson added. The Mirror reported that the previously “trusted employee” there had been struck off and sacked from their job.

Ian Hulme, the ICO’s executive director for regulatory supervision, said in a statement “people should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation”. “When this trust is broken, it’s right that the law allows us to take action. “We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so.”

Published in Dawn, June 18th, 2026