A London hospital employee attempted to sell medical records belonging to Catherine, Princess of Wales, in 2024, around the time she underwent abdominal surgery before her cancer diagnosis, according to reports by the BBC and other British news organizations.
The Information Commissioner’s Office, Britain’s independent data privacy authority, said in a statement on Wednesday that it had issued a former health care professional with “a formal caution” for the “deliberate misuse” of sensitive personal information. The regulator added that the person had made “an offer to disclose it for financial gain.”
The regulator did not name the person whose medical records were misused but the BBC and several British news outlets reported that they belonged to Catherine.
Buckingham Palace referred questions about the matter to the I.C.O. The London Clinic also declined to confirm the identity of the person whom the records belonged to. It said that the employee involved in the episode, whom it also did not name, was no longer working at the hospital.
Catherine underwent abdominal surgery in January 2024 at the London Clinic, a private hospital that often treats members of the royal family. At the time, she had stepped away from her royal duties, and in March that year she revealed that she had been diagnosed with cancer.
The same month, the London Clinic reported an information security breach, according to the regulator, which said it began a criminal investigation.
In its findings, released on Wednesday, the I.C.O. said that it had determined that a reprimand to the employee was a sufficient response, and that it had not found any negligence by the hospital.
In January 2025, Catherine announced that her cancer was in remission. Since her treatment ended in late 2024, she has gradually returned to public events.
Catherine’s private medical information has been targeted before.
In 2012, two Australian radio hosts prank called the Edward VII Hospital, where Catherine had been admitted after suffering from morning sickness. The hosts pretended to be Queen Elizabeth and King Charles III, and a nurse at the hospital disclosed Catherine’s treatment. The nurse later died by an apparent suicide.
