Kate Middleton Could Sue Over Medical Records Breach

Kate Middleton could sue after attempts to access her medical records at a hospital where she had abdominal surgery, an expert told Newsweek.

The Princess of Wales was at The London Clinic for a little under two weeks and it is believed a staff member attempted to access her patient data during that time.

The hospital launched its own investigation and reported the issue to the Information Commissioner's Office [ICO], Britain's data watchdog, which has the power to impose fines.

However, if her privacy has been breached and her data compromised, she would be entitled to a pay out.

It comes in the fourth week of wild speculation over her health that has spiraled out of control during a prolonged absence from the public eye.

Jon Baines, a senior data protection specialist at Mishcon de Reya, told Newsweek: "Individuals, such as—in this case—The Princess of Wales, can also bring claims for compensation under the U.K. GDPR, and for 'misuse of private information,' where their data protection and privacy rights have been infringed."

He also said a crime may have been committed under Section 170 of Britain's Data Protection Act, which stipulates that an offense is committed if someone obtains or discloses personal data "without the consent of the controller," namely the clinic.

"The ICO themselves have the power to bring prosecutions," he continued. "Although there are defenses available to someone charged with the offense—such as that they reasonably believed they had the right to 'obtain' the personal data, or on grounds of public interest—such defenses are unlikely to apply where someone knowingly accesses patient notes for no valid or justifiable reason."

If convicted, he said any staff member would get a criminal record but would not go to prison: "It remains an offense only punishable by a fine. In England and Wales, although the maximum fine is unlimited, there is no possibility of any custodial sentence.

"Recent prosecutions by the ICO under section 170 have seen a council officer fined for unlawfully accessing social services records, and a tracing agent fined for illegally obtaining personal information to check if customers of a high street bank could repay their debts."

And the clinic's own processes could also come under the microscope, if the watchdog believes it does not have "appropriate technical or organizational measures" for keeping personal data secure, Baines said.

"Serious failures to comply with that obligation could lead to civil monetary penalties from the ICO, to a maximum of £17.5m although, in reality, given that such civil 'fines' must be proportionate, it is rare that such large sums are even considered by the ICO," he added.

While Kate could sue, it is highly unlikely she will owing to the royal family's longstanding policy of trying to keep its reputation out of the courts.

Prince Harry and Meghan Markle had to hire outside legal counsel in order to sue British newspapers in three separate cases, two for phone hacking and one privacy case, filed in 2019.

The Duke of Sussex outlined the difficulty during his U.K. lawsuit against Rupert Murdoch's U.K. media empire.

A March 2023 witness statement, seen by Newsweek, read: "When I did actually issue my hacking claims against both MGN and NGN in October 2019, I was summoned to Buckingham Palace and specifically told to drop the legal actions because they have an 'effect on all the family.'

"This was a direct request (or rather demand) from my father, Edward Young [Queen Elizabeth II's private secretary] and my father's Private Secretary, Clive Alderton."

He added: "Obviously bringing a claim via Gerrard Tyrrell, as the institution's lawyer taking direction from Clarence House, was a no-go.

"It was therefore suggested to me that I break with royal tradition and instruct my own solicitor to commence phone hacking proceedings against NGN on my behalf."

There have been cases though. Kate and Prince William sued in France after photographs were taken on a long lens of the princess sunbathing topless in the private grounds of a French chateaux belonging to the Earl of Snowden.

The images were published in French celebrity magazine Closer, which was ordered to pay €100,000 in fines.

King Charles III also famously successfully sued The Mail on Sunday after it published an extract from his diary detailing his thoughts about the Chinese Communist leadership following the handover of Hong Kong.

Al Russell, chief executive of The London Clinic, said in a statement: "Everyone at The London Clinic is acutely aware of our individual, professional, ethical and legal duties with regards to patient confidentiality.

"We take enormous pride in the outstanding care and discretion we aim to deliver for all our patients that put their trust in us every day.

"We have systems in place to monitor management of patient information and, in the case of any breach, all appropriate investigatory, regulatory and disciplinary steps will be taken.

"There is no place at our hospital for those who intentionally breach the trust of any of our patients or colleagues."

Jack Royston is Newsweek's chief royal correspondent based in London. You can find him on X, formerly Twitter, at @jack_royston and read his stories on Newsweek's The Royals Facebook page.

Do you have a question about King Charles III, William and Kate, Meghan and Harry, or their family that you would like our experienced royal correspondents to answer? Email royals@newsweek.com. We'd love to hear from you.

Update 3/21/24, 9:32 a.m. ET: This article was updated with a statement from Al Russell.