EU data protection laws are reasonable. They allow for public health authorities to take all the steps you're suggesting, and they require companies which hold such information to make them available to those authorities. They do not allow researchers to transfer data to a third party to perform further research. Simple, clear, reasonable, and protective of the basic human rights of the study participants.