At the same time, in the event of data related to health, such as diagnosed symptoms of a medical condition, medical examinations, etc., i.e., sensitive personal data, for which special protection applies, their processing can only be carried out under the strict limitations of Article 9, paragraph h,i of the GDPR. Thus the processing needs to be necessary for the purposes of preventive or occupational medicine, assessment of the worker's fitness for work, medical diagnosis, provision of health or social care or treatment or management of health and social systems and services under Union or national law or under a contract with a health professional. or processing is required for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare and medicines or medical devices, on the basis of Union law or the law of a Member State which provides for appropriate and specific measures to protect the rights and freedoms of the data subject, in particular professional secrecy.

Specifically, the GDPR has included in recital 46, as a legitimate basis for the use of such data that: "...certain types of processing may serve important public interest purposes on the one hand and the vital interests of the data subject on the other, such as, for example, when the processing is necessary for humanitarian purposes, including the monitoring of epidemics and their spread or in situations of humanitarian urgency, in particular in cases of natural and man-made disasters." Therefore, the intended processing is considered as necessary for human life and this is its legal basis.

Taking measures to protect health on the part of the State includes appropriate actions for this purpose, such as the provision of special purpose licences, remote working, decontamination of premises, and so on. The responsibility of the body managing any outbreaks implies full compliance with medical confidentiality, so that confidential data does not lose its character and the handling of medical data is carried out under the necessary security conditions.

Finally, in accordance with the decisions of the State, its relevant instructions concerning the operation of the entity must be implemented in a manner that does not prejudice or discriminate against the rights or freedoms of the employees, who must be fully informed of the measures taken by the entity.

In any case, the reasonable use of health data to protect the public interest and the good of health requires the collection of personal data to follow the principles of necessity, lawfulness, objectivity and transparency, purpose limitation, limitation of the storage period, integrity and confidentiality, but also minimization, along with the obligation to take appropriate technical and organizational measures (such as encryption) to avoid the infringement of personal data.