In a statement, Managed Isolation and Quarantine deputy chief executive Megan Main said a First Security guard posted an image on August 15 to a private group on Snapchat while on shift at the Sheraton Four Points managed isolation facility.
It contained the names, room numbers and arrival and departure dates of 27 returnees staying at the facility, along with the names and room numbers of five staff members.
It was removed around midday that day as soon as agencies became aware and had identified the security guard as the source.
First Security have confirmed the image has been deleted from the guard's phone.
Main said the investigation had established the guard had legitimate access to the list, as part of their role of processing and monitoring returnees going outside the building for exercise or other reasons.
"The actions of this person were unacceptable, and we sincerely apologise to those people whose privacy was breached. We have contacted all of those affected to inform them of the incident."
First Security is also undertaking an employment investigation. The Office of the Privacy Commissioner has also been notified.
