A more hopeful interpretation. This can be a tool for good. It's not necessary for the state to have access. We already have access.
This capability is precisely what we need to generate data that can be used to resolve this crisis and allow us to safely exit from quarantine.
The GDPR allows individuals to request access to their own data.
They can voluntarily share this with their health systems, communities, and governments, such as when testing positive for SARS-CoV-2. This doesn't have to be open-ended, just for recent data that could help track transmission and find other contacts.
On the flip side, individuals who don't know if they're carriers can plug their own data into a system that relates it with the movements of affected people and warns them if they need to get tested.