In relation to lawfulness of processing, the General Data Protection Regulation ((EU) 2016/679) (GDPR) already allows public health authorities and employers to process personal data in an emergency without an individual's consent. The legal bases include:

In an employment context, the processing of personal data may also be necessary for compliance with a legal obligation to which the employer is subject such as, obligations relating to health and safety at the workplace, or to the public interest (such as the control of diseases and other threats to health). The statement contains some FAQs and the answers note the relevance of national laws.

The core principles of data processing must be adhered to; for example, personal data should still be processed for specified and explicit purposes and individuals should be provided with easily accessible transparent information on the data processing activities. Data security and confidentiality policies should ensure that data is not unlawfully disclosed. Also, the underlying decision-making and measures implemented to manage the COVID-19 emergency should be documented.

The use of mobile location data to monitor, contain or mitigate the spread of COVID-19 implies the possibility of geolocating individuals or sending them public health messages in a specific area. In principle, operators can only use location data when made anonymous or with individuals' consent. However, Article 15 of the E-Privacy Directive (2002/58/EC) enables member states to introduce legislation to safeguard public security, with adequate safeguards such as, a judicial remedy. To be proportionate, the least intrusive solutions should be used and be strictly limited to the duration of the emergency.