GDPR and Coronavirus

We are an international university (and the university is also a city where everyone who works and studies also lives/resides).  As such, we are currently placing individuals who are returning from high risk areas (of the Coronavirus) or those whom have had contact with those in high risk areas (i.e., roommates) in quarantine.

It would be great to receive some guidance on things we should be able to do in terms of GDPR in the context of:

• Informing them we will place them in quarantine
• Sharing information of those who are placed in quarantine (we may for example send to housekeeping, their course instructors, etc.)

You must inform the individuals returning from high risks areas about how you will process their data concerning health (collecting, sharing, storing data), why you are collecting their data about health. Please consider that while health data is included among the special categories of data under Article 9 GDPR, the reasons for public health allow you to process these data without consent. Although consent is not needed, you always must inform individuals about how their data are processed.
You should also reveal how long will you retain this data (as long as the public health risk is concrete)

You can find more information about:
Public health reasons for processing special categories of data in Paragraphs 52-55 of the Preamble of GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=IT#d1e1374-1-1 />Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/