The shooting at a mother-child centre in southwestern Germany yesterday, in which a 24-year-old man killed two women and injured a child before turning the gun on himself, has reopened an uncomfortable continent-wide debate about the policing of mental health. The assailant, identified as Max S., had a documented history of severe mental illness and had been under outpatient psychiatric care. Yet German authorities, bound by the EU’s General Data Protection Regulation (GDPR) and its stricter national interpretations, were unable to share his medical records with police firearms licensing officers. The result: a legal loophole that allowed a known psychotic individual to purchase a handgun legally in 2023.
This tragedy is not an isolated event. A 2024 European Commission report found that 12 of the EU’s 27 member states do not require automatic cross-checking of mental health records against firearm licence databases. In Germany, the legal framework explicitly prioritises medical privacy over public safety. Clinicians are forbidden from reporting patients who may pose a risk of violence unless a specific threat has been made against an identifiable person. This is a recipe for repeated tragedies.
Contrast this with the United Kingdom. Since the 1996 Dunblane massacre, the UK has implemented a mandatory national firearms licensing system that includes rigorous checks of medical history. General practitioners are required by law to share relevant mental health information with police. The result: the UK’s annual firearm homicide rate consistently clusters around 0.04 per 100,000 people. In Germany, that rate is 0.2 per 100,000 a fivefold difference. The UK model does not sacrifice civil liberties needlessly; it balances them with collective security. After the 2017 Westminster Bridge attack, the UK extended its data-sharing framework to include counter-terrorism. But the principle remains the same: when public safety hangs in the balance, medical confidentiality must yield.
Critics argue that such measures stigmatise mental illness. But the data say otherwise. The UK’s approach has not led to a surge in involuntary hospitalisations or discrimination against people with mental health conditions. What it has done is create a predictable, transparent system where risk is assessed by professionals, not left to chance. In Germany, the opposite has occurred. The lack of data sharing means that law enforcement often learns of a perpetrator’s psychiatric history only after a massacre.
The EU’s response so far has been characteristically bureaucratic. The European Parliament’s Committee on Civil Liberties announced a ‘review’ of the interaction between GDPR and firearms licensing, which will likely produce a non-binding resolution in 12 to 18 months. This is insufferably slow. The families of the dead in Germany cannot wait another year for a report.
What is required is a Europe-wide data-sharing framework, akin to the UK’s, that automatically flags to firearms licensing authorities any individual who has been involuntarily detained under mental health legislation, or who has a diagnosis of a severe psychotic disorder. This must be implemented at the national level without waiting for Brussels. The UK has proved that such a system reduces deaths without eroding trust in the medical profession.
After the 2019 Halle synagogue shooting, where the perpetrator also had a history of mental illness, German authorities promised change. Nothing happened. If yesterday’s tragedy does not catalyse a legislative shift, then the EU’s commitment to protecting its citizens is hollow. The UK model is not perfect it requires constant investment and rigorous enforcement. But it is demonstrably better than the status quo. Europe must choose: more process, or more victims.
