The federal Department of Foreign Affairs and Trade (DFAT) breached privacy protocols during COVID-19 repatriation planning when an administrative officer accidentally left email addresses unmasked in a mass distribution list sent to stranded citizens.