Surely all this talk about breaching Germany's strict privacy laws is missing the point. It seems to me the physician(s) who examined Lubitz and had serious misgivings as to his health should have refused to clear him for flying duty. Any resulting repercussions would have been kept confidential between the physician(s) and Germanwings/Lufthansa.
Actually, the privacy law is the whole point. Doctors are not allowed to contact the employer, if they even know who that is. Yes, the AME does know, but has it even easier by informing the LBA (german CAA) and they will pull his license, just takes about six weeks. But any normal MD does not need to know the employer, the profession or anything else about his patient, and cannot contact any other third party except in case of a direct threat to others. Which apparently none of his doctors saw. There is absolutely no direct link between employer and MD.