A Betrayal of Trust
A former healthcare worker has been cautioned by the UK's privacy watchdog after attempting to sell the Princess of Wales's confidential medical records — in what the Information Commissioner's Office has called a deliberate and calculated breach of trust.
The individual, believed by The Mirror to be a nurse who has since been struck off and dismissed, worked at The London Clinic when Catherine was admitted on 16 January 2024 for planned abdominal surgery. The ICO launched a criminal investigation in March of that year after the hospital itself reported the suspected breach — a significant move that sent shockwaves through both the Marylebone institution and Kensington Palace.
The ICO confirmed this week that a formal caution had been issued under section 170(5) of the Data Protection Act 2018, describing the conduct as involving "the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain — a clear breach of trust."
"People should be able to trust that the personal information they're giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it's right that the law allows us to take action." — Ian Hulme, ICO
What We Know About the Breach
Catherine spent 13 days at The London Clinic following her surgery — an unusually long stay that had already fuelled intense public speculation. The hospital, near Regent's Park in central London, is the UK's largest independent private hospital and has long been the facility of choice for the Royal Family; the late Queen Elizabeth II, Prince Philip and former prime ministers including Clement Attlee and Anthony Eden have all been treated there. Queen Camilla has served as its patron since 2017.
Crucially, King Charles was also a patient at the clinic at precisely the same time as Catherine, having been admitted for treatment on an enlarged prostate. Doctors subsequently discovered he had a form of cancer. Following the alleged breach involving the Princess's records, the hospital contacted Buckingham Palace directly to confirm that the King's medical files had not been compromised.
The ICO was notified of the incident within 72 hours — as required by official guidelines — and the investigation that followed lasted more than two years. It is understood the regulator agreed to the sanction of the individual being removed from their post and struck off, in addition to the formal caution. The maximum penalty for unlawfully accessing medical records without consent is an unlimited fine, and Catherine also holds the right to pursue a civil claim. It is understood she has no plans to do so.
The Hospital's Response
The London Clinic moved swiftly to distance the institution from any suggestion of systemic failure. A spokesperson said the incident was "sad and isolated," adding that the ICO's own investigation found no wider organisational failings and no regulatory breaches by the hospital itself.
"We all take considerable pride in delivering the very highest standards of care and discretion for every patient at The London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion."
The ICO echoed that position, confirming it "did not identify any failings that would meet the threshold for regulatory enforcement" in terms of the hospital's broader conduct.
Kate's Recovery — and Her Return
The attempted breach occurred against an extraordinarily sensitive backdrop. Catherine's surgery had been announced with very little detail, and in the weeks that followed, social media was awash with rumour, speculation and — in some cases — deeply distressing content targeting the Princess and her family. It was not until a personal video message in March 2024 that Catherine confirmed she had been diagnosed with cancer, detected during the surgery itself.
She has since made a remarkable recovery. In January 2025, the Princess confirmed she was in remission, and she has steadily resumed public duties in the months since. This week, she was seen smiling and laughing alongside fellow royals at the Order of the Garter service at Windsor — a poignant milestone, given she had missed the same ceremony a year earlier while undergoing cancer treatment.
The closure of the ICO case draws a formal line under one of the most unsettling privacy breaches to have touched the Royal Family in recent memory — though the questions it raised about the safety of celebrity and royal medical data are unlikely to fade quite so quickly.
