Article 25: When using personal information to conduct automated decision making, the transparency of the decision making and the fairness and reasonability of the handling result shall be guaranteed. Where an individual believes automated decision making creates a major influence on their rights and interests, they have the right to require personal information handlers to explain the matter, and they have the right to refuse that personal information handlers make decisions solely through automated decision making methods.

Article 35: State organs handling personal information for the purpose of fulfilling statutory duties and responsibilities shall notify individuals according to the provisions of this Law and obtain their consent, except where laws or administrative regulations provide that secrecy shall be protected, or where notification and obtaining consent will impede State organs’ fulfillment of their statutory duties and responsibilities.

There's wiggle room in article 35, but I guess that's unavoidable for like investigations and stuff. Hopefully that's not used as a massive loophole.

The second part is specifically there for pandemic/natural disasters. Where the time it takes to get consent will hamper mitigation efforts. It's also important that even in those instances, upon the end of the disaster, everyone is notified and told what data was collected and why.