I would also assume that the GDPR would impose severe restrictions as to the allowed duration of data collection for contact tracing purposes (in the sense that it shouldn't be legal anymore once Coronavirus ceases to be a major threat), but IANAL, so I could be wrong.