The BBC reports that outsourcing services provider Serco has apologised after accidentally sharing the email addresses of almost 300 contact tracers, which could put them in breach of data protection rules.

Serco is training staff to trace cases of Covid-19. The error was made when new trainees were emailed to give guidance about contacts for training, the BBC says.

The outsourcing services provider is one of the companies hiring, training and running the 15,000 contact tracers who do not have clinical training. 

The error involved an email sent to tell the new trainees not to contact its help desk to request training details. The staff member who sent the message put the recipients’ email addresses in the CC section of the email, rather than the BCC – which is not visible to other recipients – revealing them to every one to whom the email was sent, the BBC says.

The contact tracers will gather contacts from Covid-19 patients and trace those people by phone or email, with a view toward slow the spread of the disease. The BBC says: “The error did not involve patients’ data but will be unhelpful for a contact tracing project that is set to ask many thousands of people who have fallen ill to share the details of their friends and acquaintances.”

The BBC says Serco told them that it had apologised and would review its processes “to make sure that this does not happen again”.

• Let us know what you think by emailing us at [email protected] or tweet us to tell us your thoughts or share this story with a friend.