The Spanish DPA (AEPD) publishes a report on coronavirus data treatments.
The report states that the GDPT explicitly recognizes in its Recital 46 as a legal basis for the legal treatment of personal data in exceptional cases, such as the control of epidemics and their spread, the mission carried out in the public interest (art. 6.1.e) or the vital interests of the interested party or other natural persons (art. 6.1.d), notwithstanding that there may be other bases such as, for example, the fulfillment of a legal obligation (for the employer in the prevention of occupational risks of its personnel). These legal bases allow data processing without the consent of those affected.
More information (in Spanish) here
Read the report here