The University of East Anglia has referred itself to the Information Commissioner after it mistakenly sent out an email containing a spreadsheet of confidential and highly sensitive personal details of dozens of students to hundreds of other students.
The spreadsheet, seen by this newspaper, contains a list of the reasons that students have had their requests for extensions accepted, alongside students' full names and university ID numbers.
The extenuating circumstances detailed in the spreadsheet include suicidal thoughts, sexual assault, and serious family illnesses and bereavements.
There are also multiple entries for anxiety, depression and other mental health conditions.
Students have expressed their anger and humiliation at the breach of their privacy.
Megan Baynes, 23, a student, described the university's action as 'a total violation of trust', and added that she is 'angry beyond belief'.
She was included in the spreadsheet due to a family member's illness, and first found out what had happened when a friend messaged her.
She said she 'felt sick' when she realised the extent of the information leak.
'I trusted my department to handle my extenuating circumstances in a sensitive manner, and instead they have quite literally put them on show for the world to see, it's humiliating.'
Sophie Atherton, 22, a student said the university have told her they are investigating the situation.
However, she said: 'It shouldn't have happened in the first place'.
She described the department as 'not very supportive at all', and said that their response to the data leak was 'not good enough'.
She added: '[I'd like to see] handwritten apologies to every single person on that list.
'I know that the university is being watched by the Office of Academic Advising, and the Competition and Markets Authority, and this is just another thing that is coming from that specific department.
'There are so many flaws in that department as a whole'.
'I've worked very closely with someone in the students' union advice team for the last 15 months. I actually sent it across to him and he said: 'They've violated data protection and you're well within your rights to make a complaint', which I think I'm very likely to do next week.'
The spreadsheet contains nine entries for students in their first year of study, 22 for second year students, and 14 third years.
In addition one student is listed as a continuing finalist from 2015-2016.
It was receieved by students in the morning of Friday, June 16, and sent from a UEA member of staff's university email address.
A second email was sent shortly afterwards, from the same account, which said: 'You may have erroneously received an email with a spreadsheet attachment.
'Could you please delete this without opening/reading.'
The university confirmed in a statement the email was 'mistakenly sent to 320 undergraduates'.
A spokesman said: 'This clearly should not have happened and the university apologises unreservedly.
'The university has launched an urgent inquiry and is offering support to anyone affected.'
'Anyone needing support should call 01603 592761.'
The number was also shared in a tweet from @uniofeastanglia.
UEA students' union undergraduate education officer Theodore Antoniou-Phillips said: 'This is a shocking and utterly unacceptable data breach that should never have happened.
'There are questions the university needs to answer both about this case itself and the antiquated systems that result in cases like this being logged on rudimentary Excel files in the first place.
'It is particularly galling given that students are required to divulge sensitive information to have an extenuating circumstances upheld.
'The least the university can do is keep their data safe.'
Welfare, community and diversity officer Jo Swo added: 'Given the university is supposed to be making mental health a priority, this is a real slap in the face to students who have sought support. We would advise any student affected to contact the student support service and the SU.'
The university said in a statement on their website that they are 'contacting all affected students to offer support'.
'The university is informing the Information Commissioner's Office.'
Comments: Our rules
We want our comments to be a lively and valuable part of our community - a place where readers can debate and engage with the most important local issues. The ability to comment on our stories is a privilege, not a right, however, and that privilege may be withdrawn if it is abused or misused.
Please report any comments that break our rules.
Read the rules here