The Information Commissioner's Office (ICO) has concluded its criminal investigation concerning the unlawful obtaining and disclosure of medical information following a breach reported by the London Clinic.

The investigation, initiated after a report in March 2024, concerned the transmission of medical information to a third party without the consent of the data controller. A former healthcare professional received a formal warning for an offence under section 170(5) of the Data Protection Act 2018. The established facts involve the abusive and deliberate use of highly sensitive personal data as well as a proposal to disclose it for financial gain, constituting a breach of trust. The ICO considered the warning to be an appropriate and proportionate coercive response. Furthermore, the investigation identified no organisational failure within the healthcare establishment that would meet the threshold for regulatory action.