...
By Jack Royston
Chief Royal Correspondent
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
A former healthcare worker who attempted to sell Princess Kate's medical records received a "ridiculously light" punishment, and the public should be told who the intended recipient or prospective buyer was, a prominent media lawyer told Newsweek.
The Information Commissioner's Office (ICO), Britain's data regulator, announced on Wednesday that a former healthcare worker had been given a criminal caution over a data breach at the London Clinic.
"The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust," the ICO said in a statement.
Read More on Celebrity News
"The ICO considers the available evidence and the public interest in every criminal investigation. In this instance, we concluded that a caution was the appropriate and proportionate enforcement response."
A caution means there will be no trial of the former healthcare professional, who will also remain unidentified. This will limit how much information enters the public domain about the case. The regulator has not identified any intended buyer.
No public finding has been made that anyone outside the clinic commissioned, instructed, induced or paid the worker to misuse the data.
...
Lawyer Says 'We Should Know' Buyer of Kate's Data
Mark Stephens, a United Kingdom-based media lawyer of the law firm Howard Kennedy, told Newsweek: "I thought that was a ridiculously light sentence and there's hardly a discouragement to do it again, particularly given it was for money."
He said the public had a right to know who any potential buyer or intended recipient was, adding that, depending on the evidence, they could have faced investigation as a possible co‑conspirator.
Stephens said that, if evidence existed that a third party solicited or encouraged the disclosure, that could raise questions about whether other offences should have been considered. There is no public finding that any such third party existed.
"I was surprised they didn't pursue conspiracy," he said, "given that [the former healthcare worker] was being paid by a third party and so I'm surprised that the third party wasn't also brought in."
Stephens suggested it "may be a dodgy private detective" but also did not rule out the possibility of a hostile foreign actor, adding: "We should know, particularly in light of what happened to [British Prime Minister] Keir Starmer."
He said there was no requirement to release the private information concerning Kate's health and added, "There's a much more sinister concern. Why have we not been told, even if there was a caution, who was the commissioner of this crime? That is vital to a proper understanding of this case."
He said the ICO or Kensington Palace should put out a statement. Both declined to comment when contacted by Newsweek.
Earlier this month, the BBC reported that arson attacks targeting property linked to Starmer had allegedly been orchestrated from Russia using the messaging app Telegram. The Russian embassy told the BBC: "We reject any attempt to associate Russia or its foreign ministry with unlawful activities."
The ICO and Kensington Palace have not disclosed who the intended recipient of Kate's medical records was, nor whether that individual was investigated, is based in Britain, or is suspected of any wrongdoing.
It is also unclear whether any intended recipient actively solicited the information, was approached by the healthcare worker or passively received the data before alerting the authorities. The ICO has not provided further details and there has been no public finding that anyone outside the clinic commissioned, instructed or induced the misuse of the data.
"Clearly the Information Commissioner knew and thought [the health worker] was less culpable than the corrupter for whom she was working," Stephens said.
"Why does it start and stop with the foot soldier? Where are the generals? Where are the commissioners of the crime?"
ICO Confirms Attempt to Sell Kate's Medical Data
The former employee was working at the London Clinic at the time. The data breach was first reported in March 2024, when Kate was undergoing treatment for cancer.
At the time, it was publicly known only that she had undergone abdominal surgery in January and had not returned to public duties.
The palace has a track record of defending medical privacy, and the breach came during a particularly difficult period for Kate, when she was the subject of widespread online speculation about her health.
There is no suggestion that the attempted sale of her medical records was linked to those rumors or that the healthcare worker knew the nature of her diagnosis. However, the incident occurred during an already intense period of public scrutiny.
The U.K.'s privacy and data protection watchdog announced the outcome of its criminal investigation on Wednesday in a statement on its website: "The ICO issued a now former healthcare professional from London with a formal caution in relation to an offense under section 170(5) of the Data Protection Act 2018.
"The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust.
"The ICO considers the available evidence and the public interest in every criminal investigation. In this instance, we concluded that a caution was the appropriate and proportionate enforcement response."
The regulator confirmed its investigation related to a "breach reported by the London Clinic in March 2024," placing it at a point when Kate had been diagnosed with cancer privately but had not yet made that information public.
Ian Hulme, executive director for regulatory supervision, said in a statement: "People should be able to trust that the personal information they're giving to healthcare settings is safe and protected from exploitation. When this trust is broken, it's right that the law allows us to take action. We will not hesitate to pursue criminal prosecution where it is necessary and proportionate to do so."
The London Clinic told Newsweek: "We all take considerable pride in delivering the very highest standards of care and discretion for every patient at The London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital."
Princess Kate's Difficult 2024
Prince William made clear just how tough 2024 was for the couple in an interview that November. Quoted by the BBC, he said: "It's been dreadful. It's probably been the hardest year in my life. So, trying to get through everything else and keep everything on track has been really difficult."
In January, Kensington Palace announced the Princess of Wales had undergone “planned abdominal surgery” at the London Clinic and at the time her condition was said to be noncancerous. The palace confirmed she would step back from public duties for a lengthy period but did not explicitly state that there would be no post-surgery photos. In the absence of updates, conspiracies began to circulate on social media.
Privately, Kate was told subsequent tests had confirmed cancer had in fact been present, and she began chemotherapy in February but chose not to reveal this to the public.
Her extended absence from royal duties, combined with limited information released by the palace, fueled intense speculation across social media, including from celebrities such as Kim Kardashian, who joined a trend posting “Where is Kate Middleton?”
The reputational crisis threatened to spiral when Stephen Colbert revived an old rumor, denied by Kensington Palace years earlier, that William had been unfaithful. Colbert later apologized.
Pressure built as the weeks passed, and in March 2024, Kate recorded a video message confirming her cancer diagnosis and describing it as a “huge shock.” She said the family had held off on releasing the information until their children were out of school for the Easter holidays, so they could come to terms with the news together in private.
March—the same month The London Clinic reported the data breach to the ICO—marked the peak of social media speculation, fueled in part by the release of a Mother’s Day photo that Kate later acknowledged she had edited.
International picture agencies issued "kill notices" for the images, instructing news outlets not to use them due to manipulation at the source.
The health worker who attempted to sell her private data may well not have known just how much she was going through, but the conduct was ruled illegal by the ICO, leading to her being issued a caution.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines