Story perspectives

ICO Cautions Ex-Nurse for Attempted Sale of Princess Kate’s Records

6/17/2026

Summary

Story summary

Information Commissioner’s Office (ICO) cautioned a former London Clinic nurse for illegally accessing Princess Kate’s medical records and attempting to sell them.
The probe started in March 2024 after the clinic reported a January breach where the nurse tried to view the princess’s notes.
Information Commissioner’s Office (ICO) found no broader organisational failures, so no regulatory action was taken, and confirmed that the King’s records were untouched and confidentiality was upheld.

History

Historical Context

The EU GDPR took effect on 25 May 2018, obligating UK firms under the Data Protection Act 2018. After a 2018 web-skimming attack, the ICO reduced its intended £183 million penalty on British Airways to £20 million in 2020, covering about 380 000 affected transactions. The regulator’s 2024 probe of a London Clinic data-access attempt shows the rule’s ongoing impact on UK health-care security.

1 of 2

Story summary

Information Commissioner’s Office (ICO) cautioned a former London Clinic nurse for illegally accessing Princess Kate’s medical records and attempting to sell them.
The probe started in March 2024 after the clinic reported a January breach where the nurse tried to view the princess’s notes.
Information Commissioner’s Office (ICO) found no broader organisational failures, so no regulatory action was taken, and confirmed that the King’s records were untouched and confidentiality was upheld.

1 / 2