ICO Issues Formal Caution to Former London Clinic Worker Over Princess of Wales Medical Records (infosecurity-magazine.com)

• ICO issued a formal caution under Section 170(5) of the Data Protection Act 2018 to a former London Clinic worker rather than pursuing prosecution.
• The worker attempted to access and sell the Princess of Wales' medical records after her 2024 abdominal surgery.
• ICO found no wider organisational failings at the clinic requiring enforcement; the individual is believed to have been struck off.

"The UK Information Commissioner's Office (ICO) has issued a formal caution to a former healthcare worker at the London Clinic who attempted to access and sell the medical records of the Princess of Wales. The regulator opened a criminal investigation in 2024 after the royal received abdominal surgery at the clinic. Under Section 170(5) of the Data Protection Act 2018, the former worker was cautioned rather than prosecuted, with the ICO describing the conduct as a 'clear breach of trust' involving highly sensitive personal information. The ICO found no wider organisational failings at the clinic and said the caution was proportionate."