Canada’s Office of the Privacy Commissioner weighs in on data processing under COVID-19:

“There are some circumstances under which organizations may collect, use or disclose personal information without consent, including:

• Collection in the interests of the individual and consent cannot be obtained in a timely way, e.g. critical illness.
• Collection and use for making a disclosure required by law, e.g. public health authority requires it.
• Disclosure requested by a government institution under a lawful authority to obtain the information and is for the purpose of enforcing or administering any law of Canada or a province.
• Disclosure made on the initiative of the organization to a government institution, which has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction, e.g. an individual is in contravention of an invoked quarantine order.
• Disclosure for acting in respect of an emergency that threatens the life, health or security of an individual, e.g. an individual requires urgent medical attention, and they are unable to communicate.

Read the full text of the guidance.

[View source.]