Investigation Into Alleged Kate Middleton Medical Records Sale Scheme Ends In “Formal Caution”

In January 2024, a patient known around the world was admitted to the London Clinic for scheduled abdominal surgery: Kate Middleton, the future queen of England. Two months later, the private facility reported a major security breach and announced the launch of an investigation, all after an employee allegedly attempted to violate patient confidentiality to access the Princess of Wales’s medical records. The employee, whose position was not specified, was disciplined this week, according to an announcement from the UK’s data protection regulator, known as the Information Commissioner’s Office (ICO).

The agency “has concluded its criminal investigation into the unlawful obtaining and disclosure of medical information to a third party without the consent of the data controller, related to a breach reported by the London Clinic in March 2024,” it writes.

“Following a full assessment under the Code for Crown Prosecutors and the ICO’s Prosecution Policy, the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018. The conduct involved the deliberate misuse of highly sensitive personal information and an offer to disclose it for financial gain, representing a clear breach of trust,” the announcement continues.

The announcement did not name Kate Middleton, nor did it allude to the patient in question’s medical status. However, the BBC, among other outlets, confirms that the investigation centered around the records belonging to the Princess of Wales.

Kate Middleton spent thirteen nights at the London Clinic in January 2024. Two months later, she announced that she had been diagnosed with cancer and was undergoing treatments including chemotherapy at the Royal Marsden Hospital, located in west London. She announced the completion of her chemotherapy that September, and that her cancer was in remission in January 2025.

Since then, she has resumed her public duties and makes a point of advocating for cancer research and improvements to the daily lives of people living with cancer. On February 4, on World Cancer Day, she shared a very personal message with patients via Instagram. “My thoughts are with everyone who is facing a cancer diagnosis, undergoing treatment or finding their way through recovery,” she said. “Cancer touches so many lives—not only patients, but the families and friends and caregivers who walk beside them. As anyone who has experienced this journey will know, it’s not linear. There are moments of fear and exhaustion. But also moments of strength, kindness, and profound connection.”

In a statement shared with The Guardian, a spokesperson for the London Clinic addressed the conclusion of the investigation, saying “We all take considerable pride in delivering the very highest standards of care and discretion for every patient at The London Clinic. We are pleased our work with the ICO has brought this sad and isolated incident to a conclusion. There were no regulatory breaches by the hospital.” The ICO appears to confirm that claim, saying “We also considered whether there were any wider organisational issues arising from the healthcare provision in this matter. Based on the evidence available, we did not identify any failings that would meet the threshold for regulatory enforcement.”