German Doctor Fined €1,000 for WhatsApp Data Leak as Berlin Scraps National Privacy Rule

A German physician has been ordered to pay €1,000 in damages after disclosing a colleague's diagnoses in a WhatsApp group chat. The ruling by the Siegburg Labour Court (Case 1 Ca 1741/25) highlights the personal liability risks that health professionals and companies face under existing data protection law — even as the German government moves to dismantle a key national requirement.

The court found that sharing the medical information violated data protection provisions, and that there was a risk of repetition. The verdict is not yet binding; an appeal to the Cologne Regional Labour Court remains possible.

National Deregulation, European Rules Stay

Alongside this case, the German cabinet in early July announced a reform of the Federal Data Protection Act (BDSG) as part of its economic stimulus and employment programme. The centrepiece: abolishing the mandatory appointment of a data protection officer for businesses with 20 or more employees, currently required under §38 BDSG.

Yet companies should not relax. The EU General Data Protection Regulation (GDPR) remains fully in force. Organisations must still appoint a data protection officer if their core activities involve large-scale processing of sensitive data or systematic monitoring of individuals. Management bears ultimate responsibility, and violations can draw fines of up to €20 million or four percent of global annual turnover.

AI Regulation Adds New Deadlines

Simultaneously, the European AI Regulation is taking shape after a Council agreement in late June. Key timelines have been set: standalone high-risk AI systems must comply by December 2027; embedded high-risk systems have until August 2028. Labelling requirements for existing AI systems are due by December 2026. The regulation itself is expected to enter into force before August.

The urgency is clear. According to the digital association Bitkom, 41 percent of German companies already use AI tools. Yet 69 percent of surveyed firms see data protection rules as a barrier to AI development, and almost 60 percent said projects to merge data pools had failed due to privacy hurdles. Experts recommend technical safeguards such as data masking and pseudonymisation.

Stricter Security for Critical Infrastructure

The NIS2 Directive adds another layer. Operators of critical infrastructure must now conduct security checks before hiring and run continuous integrity reviews. One-off background checks no longer suffice — regulators demand an ongoing process to manage access risks and personnel trustworthiness.

Meanwhile, a planned labour law reform would allow employers to request a medical certificate from the first day of illness. Labour lawyers warn this will affect how companies manage absenteeism and process sensitive health data. Official guidance on the interplay between national regulations and the GDPR in the employment context is expected in autumn 2026.

For German businesses, the message is contradictory: less bureaucracy at home, but tighter EU-level requirements and rising litigation risks. The WhatsApp case in Siegburg is a reminder that the cost of getting data protection wrong can be personal — and expensive.

en | boerse | 69798916 |