One of the key features of GDPR is the requirement for 'privacy by design' ... design protection of privacy into your product from the start, rather than relying solely on safeguards and policies. This is possible even under the urgency of COVID-19 response, and is probably essential if public trust and therefore engagement is to be maintained.