From an article on WSJ-online (Wall Street Journal):
The person familiar with the case said Mr. Lubitz was undergoing treatment for depression elsewhere in the Rhineland area of western Germany.
Under German law, a doctor isn't required to inform the patient’s employer about any illness, nor should the note excusing him or her from work include any information about the patient’s condition.
Hans-Peter Hartung, the head of University Hospital’s department of neurology, said that while doctors in Germany weren't required by law to inform the police or a patient’s employer if the condition seemed like it could pose risks for others, they had discretion to do so.
“We are entitled under the balance of risks, and if there are looming problems, to breach medical confidentiality” by contacting the police or a patient’s employer, Mr. Hartung said.
Jochen Lamp, spokesman for the German association of psychiatrists, said only very unusual circumstances would prompt a psychiatrist to breach medical confidentiality as legal consequences of such a move can be severe.
Just my simple minded opinion but I would think changes need to be made here. Having said that considering a post I read quite awhile back that indicated that the German Pilot's Union considered ACARS data transmission to be a breach of privacy and that therefore LH ACARS data is one, rudimentary, two encrypted, and three can only be read upon approval by the Works Council this will not happen anytime soon with regard to German pilots. Personally, I am in agreement with the 'need to know' principle and as a PAX I would think airline management has a 'need to know' if any pilot has serious mental health issues.