A former healthcare worker tried to sell Princess Kate’s confidential patient medical information related to her abdominal surgery at a prestigious private clinic used by the royal family, the Information Commissioner’s Office said in a statement.
The former employee was working at The London Clinic at the time, and the data breach was first reported in March 2024, when Kate was secretly undergoing treatment for cancer.
At the time, all that was known publicly was that she had undergone abdominal surgery in January and had not returned to public duties.
Why It Matters
The palace has a track record of fiercely defending medical privacy, but the breach also came at a particularly difficult time for Kate, when she was the subject of viral conspiracy theories falsely alleging she had died.
There is no suggestion the attempt to sell her medical records was directly related, or that the health worker knew she had cancer. However, the breach may have added to what was already a highly pressured and difficult period.
The ICO Confirms Attempt to Sell Kate’s Medical Data
Britain’s privacy and data protection watchdog announced the outcome of its criminal investigation on Wednesday in a statement on its website: “The ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018.
“The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.
“The ICO considers the available evidence and the public interest in every criminal investigation. In this instance, we concluded that a caution was the appropriate and proportionate enforcement response.”
The regulator confirmed its investigation was related to a “breach reported by the London Clinic in March 2024,” placing that disclosure at a stage in Kate’s timeline when she knew she had cancer but had not announced her diagnosis publicly.
Ian Hulme, Executive Director for Regulatory Supervision, said in a statement: “People should be able to trust that the personal information they’re giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it’s right that the law allows us to take action. We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so.”
Princess Kate’s Difficult 2024
Prince William made clear just how tough 2024 was for the couple in an interview that November. Quoted by the BBC, he said: “It’s been dreadful. It’s probably been the hardest year in my life. So, trying to get through everything else and keep everything on track has been really difficult.”
In January, Kensington Palace announced the Princess of Wales had undergone “planned abdominal surgery” at the London Clinic and at the time her condition was said to be non-cancerous.
The palace confirmed she would step back from public duties for a lengthy period but did not explicitly state there would be no post-surgery photos, and in the absence of updates, conspiracies began to circulate on social media.
Privately, Kate was told subsequent tests had confirmed cancer had in fact been present, and she began chemotherapy in February but chose not to reveal this to the public.
Her extended absence from royal duties, combined with limited information released by the palace, fueled intense speculation across social media, including from celebrities such as Kim Kardashian, who joined a trend posting “Where is Kate Middleton?”
The reputational crisis threatened to spiral when Stephen Colbert revived an old rumor, denied by Kensington Palace years earlier, that William had been unfaithful. Colbert later apologized.
Pressure built as the weeks passed, and in March 2024, Kate recorded a video message confirming her cancer diagnosis and describing it as a “huge shock.”
She said the family had held off on releasing the information in order to wait until their children were out of school for the Easter holidays, so they could come to terms with the news in private, together.
March—the same month The London Clinic reported the data breach to the ICO—marked the peak of social media speculation, fueled in part by the release of a Mother’s Day photo that Kate later acknowledged she had edited.
International picture agencies issued “kill notices” for the images, instructing news outlets not to use them due to manipulation at the source.
The health worker who attempted to sell her private data may well not have known just how much she was going through privately, but nevertheless, the conduct was ruled to be illegal by the ICO, leading to her being issued a caution.
‘ The preceding article may include information circulated by third parties ’
‘ Some details of this article were extracted from the following source www.newsweek.com ’
