Outsourcing firm Serco has apologised after accidentally sharing the email addresses of almost 300 contact tracers.
The company is training staff to trace cases of Covid-19 for the UK government.
It made the error when it emailed new trainees to tell them about training.
Serco said it had apologised and would review its processes “to make sure that this does not happen again”.
Contact tracing is a system used to slow the spread of infectious diseases like coronavirus. It is already being used in other countries including Singapore and Germany.
In the UK, Health Secretary Matt Hancock said 21,000 contact tracers have been hired, some of whom are healthcare professionals.
They will gather contacts from Covid-19 patients and trace those people by phone or email to slow the spread of the disease in the community.
Serco is one of the companies hiring, training and operating the 15,000 contact tracers who do not have clinical training.
But the mistake may leave the firm in breach of data protection rules. It is understood that at least one member of staff has raised the issue with the Information Commissioner.
How will the UK’s coronavirus app work?
Serco fined £19m over tagging scandal
Two ex-Serco bosses charged with fraud