DPAs really need to step in here and start enforcement actions. GDPR Art. 5 (1) b prohibits abusing data for another purpose, and hiding a "consent" for that somewhere in the T&C is not sufficient.

Also, due to the incredible damage such cases cause (people will provide fake data), there need to be severe penalty for such abuses - not just financial, serious jail time.

Edit to add: Art. 6 GDPR is pretty clear -processing data is legal only to the extent that one of the subclauses applies. a) Something hidden in T&C isn't valid consent, b) selling the data is not necessary to fulfill the contract (serving food), c) collecting the data is but selling the data isn't necessary for compliance with the contact tracing obligation, d) selling the data isn't necessary to protect the interests of the customer, e) there is no public interest in selling the data (quite the opposite!), leaving only f) legitimate interest. Anyone claiming that will likely learn that others disagree with this being a _legitimate_ interest that is not overridden by the data subject's right to privacy.