The Guardian revealed on Monday that Australia’s immigration department accidentally disclosed the personal details of world leaders who attended the G20 summit in Brisbane last year, including US president Barack Obama, Russian president Vladimir Putin, German chancellor Angela Merkel and many others.

The mistake happened when an immigration employee sent the leaders’ passport and visa details to an unauthorised recipient at the organising committee of football’s Asian Cup, staged in Australia in January.

The world leaders were not told about the breach, after the department deemed the risks of the breach to be “very low”.

We asked a panel of security and data experts what they thought about the information disclosed, how it could be used and whether the department was right not to inform those affected.

Chris Gatford, director of Hacklabs

What happened here is an email was sent from one person to the wrong user, which sent effectively the personally identifiable information of the world leaders.

At first thought, if that’s all it contained, I actually thought the risk for the leaders was relatively low. Let’s face it, they are probably the most well-known people on the planet.

If ... it was ordinary people it probably would have been more of a problem.

The usefulness of the story is: what else don’t we know? How frequently is information being lost by the Australian government and not being disclosed?

Steve Wilson, principal analyst at Constellation Research

For an ordinary person ... passport details could be used for identity theft. In this case there’s probably no real risk of identity theft of Angela Merkel.

What I’d be worried about is whether that level of detail could be used to index those people in different databases to find out more things about them. The threat is more about the other information that could be gleaned from finding out more data.

If you had access to other commercial data sources you could probably start to unpack their travel details, and that would be a security risk.

If it’s true that [the immigration department] knew about this without notifying them, then that is deeply concerning. It’s as much to do with transparency, but it’s also about not presuming to act on someone else’s behalf.

If a VIP has had their details exposed then you need to give them every opportunity to be made aware of the situation and the risks. You’re only prolonging the agony by not acting.

Neil Fergus, chief executive officer at Intelligent Risks

It does seem an unusual decision to have been made under the circumstances not to notify them.

I’m not sure at what point there has to be a security assessment to advise people whether their personal details have been disclosed.

But I would have thought that just as a basic diplomatic courtesy it would have been appropriate to advise the ambassadors of the countries about what has happened, and equally to assure them that there were no security concerns. But by not disclosing it you make an issue out of it.