Germany’s Top Court Weighs Whether Leaked WhatsApp Messages Can Trigger GDPR Payouts

A former medical assistant who lost her job after a friend forwarded private chat messages to her employer’s partner is asking Germany’s highest civil court to award her €7,500 in damages under Europe’s data protection regime.

The case, heard by the Federal Court of Justice (BGH) in Karlsruhe on 30 July, hinges on a question that could reshape how ordinary people handle digital correspondence: does the General Data Protection Regulation apply when someone shares another person’s private messages outside a professional setting?

A Friendship Falls Apart, a Job Disappears

The dispute traces back to a personal falling-out. After the two women had a rift, the friend sent WhatsApp conversations to the employer’s life partner. That leak proved costly — the clinic where both women worked dismissed the assistant, who argues the disclosure constituted a serious breach of her data rights.

Lower courts have split on the matter. In 2024, the Frankfurt Regional Court sided with the claimant and ordered compensation. A year later, the Frankfurt Higher Regional Court reversed that ruling, invoking the GDPR’s so-called household exemption, which excludes purely personal or family activities from the regulation’s reach.

Luxembourg May Have the Final Word

During oral arguments, BGH judges wrestled with whether forwarding messages to a third party — particularly when it triggers employment consequences — can still be classified as a private activity. Justice Koch signalled that referring the case to the European Court of Justice is a live option, since Luxembourg holds ultimate authority over interpreting EU law.

Should the ECJ determine the GDPR applies in such scenarios, the implications would extend well beyond this single dismissal. Individuals could face liability for passing along chat content to employers or others without permission, a prospect that has legal experts and worker advocacy groups watching closely.

The BGH did not issue a ruling or referral decision on the first day of hearings. A decision is expected in September, and the outcome could set a precedent for how messenger communications are treated under European privacy law across the continent.