WhatsApp Blunder Costs Doctor €1,000 as Coalition Proposes Sweeping GDPR Relief for 99% of Firms

The risks of casual data sharing came into sharp focus when the Siegburg Labour Court ordered a doctor to pay €1,000 in non-material damages on 22 May 2026. She had shared a colleague's diagnoses in a WhatsApp group. The court stressed that end-to-end encryption alone does not safeguard patient data.

That ruling underscores precisely the kind of exposure that privacy advocates say could grow if Germany's coalition government succeeds with its planned overhaul of the General Data Protection Regulation. At the beginning of July 2026, the coalition committee agreed on far-reaching exemptions designed to relieve 99 percent of German businesses — particularly small and medium-sized enterprises and clubs — from central GDPR obligations. The proposals would reduce the requirement to appoint in-house data protection officers and shift more oversight authority to the Federal Commissioner for Data Protection (BfDI).

Critics have pushed back hard. Data protection experts, supervisory authorities and civil society organisations warn that the planned relief could dilute existing safeguards. While the government also intends to ease documentation duties, specialists emphasise that the core principles of the GDPR are meant to stay intact.

With overlapping compliance deadlines on the horizon, keeping risk documentation in order is more important than ever — and a structured approach makes all the difference. A free toolkit gives you 41 ready-to-use templates, checklists, and training materials for everything from fire safety to lone working, helping you document workplace risks correctly and efficiently. Download the free Risk Assessment Toolkit

Pay Transparency Deadline Missed, New Obligations Loom

The clock has already run out on a separate EU requirement. Germany missed the 7 June 2026 deadline to transpose the EU Pay Transparency Directive into national law. A domestic statute is now not expected before early 2027. Once enacted, the new rules will carry significant teeth.

The first comprehensive pay structure reports will likely be due from June 2028. Employees will gain expanded rights to request information on salary levels for comparable roles. Employers that violate the rules face damages claims stretching back at least three years, plus fines and coercive penalties. Currently, only about one in five job advertisements includes concrete salary data. Private recruitment agencies and temporary staffing firms lead on transparency; the management and consulting sector lags behind.

IT Security, Digital Records and a New Withdrawal Button

The compliance calendar for 2026 and 2027 is packed. From August 2026, violations of the EU AI Act can trigger sanctions. The NIS2 cybersecurity directive must be transposed by October. The Digital Operational Resilience Act (DORA) is already in force, placing added duties on software manufacturers.

On 19 June 2026, a new obligation took effect for online retailers in the B2C space: they must provide a withdrawal button. Its design must comply with data-minimisation principles.

A bigger shift arrives on 1 January 2027, when the transition period for electronically supported company audits (euBP) ends. From that date, employers must keep payroll and social security records exclusively in an electronic, audit-proof format. The practical burden of these overlapping deadlines, combined with the unsettled debate over GDPR relief, leaves many firms juggling both risk and reform.

en | boerse | 69775868 |