Coronavirus and Data Protection guidance from the Catalan Data Protection Authority:

• Under Articles 6.1.(e) and 9.2.(i) GDPR, health authorities may share health data when this is needed for reasons of public interest in the field of public health, such as protection against serious trans-boundary health threats, or to guarantee high levels of quality and safety of healthcare and of medicines or health products, on the basis of Union or Member State law.
• Under Law 18/2009, public health employers who are aware of facts, data or circumstances that may constitute a serious risk or danger to the health of the population must inform the health authorities, who must ensure the protection due to personal data.

Read the full guidance.

[View source.]