The Spanish DPA published a report on processing of data in relation to the Covid19

The Spanish DPA (AEPD) publishes a report on coronavirus data treatments.

The report states that the GDPT explicitly recognizes in its Recital 46 as a legal basis for the legal treatment of personal data in exceptional cases, such as the control of epidemics and their spread, the mission carried out in the public interest (art. 6.1.e) or the vital interests of the interested party or other natural persons (art. 6.1.d), notwithstanding that there may be other bases such as, for example, the fulfillment of a legal obligation (for the employer in the prevention of occupational risks of its personnel). These legal bases allow data processing without the consent of those affected.

More information (in Spanish) hereĀ 

Read the report here