Alice has a business relationship with Bob, which involves both keeping contact information and enough physical interaction to count as a contact. Charlie contacts Alice and requests Bobs contact details without proving their identity. As I understand it to share this information would be a breach of article 5(1)(f) the GDPR in that Alice has not "ensure[d] appropriate security of the personal data", and would therefore be illegal.
If Charlie claims, but does not prove, to be working for the UK test and trace service does this change the situation? Note that it is reported that the test and trace contacts are protected only by "it'll be obvious you're talking to a professional".