Coronavirus and GDPR – the Belgian authority weighs in:

• Public health is paramount and prevention and the right to privacy are not incompatible.
• Follow the instructions of the competent authorities so that all measures taken are proportionate.
• Even in the context of taking preventive health measures, the general principle is that any processing of personal data must meet the conditions of article 6.1 of the GDPR (e.g protection of vital interests).
• Process only the minimum necessary amount to achieve the desired purpose.
• Be transparent with regard to the measures taken and sufficiently inform their workers and visitors about the purposes of processing and the duration of storage of personal data collected.
• Generalized and systematic checks by employers are not proportional.
• Do not send questionnaires about travel history or symptoms.
• Do not reveal the names of employees who tested positive.

Read the full guidance.

[View source.]