Someone, sooner or later, is going to get themselves and their organisation in deep, deep trouble for breaching GDPR rules. It's very simple: if something is covered by them, don't work on it or discuss it in public. Because it can be photographed and/or recorded.
In first class on a train and the person behind me is having a needless and needlessly loud (both) phone conversation about some sort of disciplinary issue involving a ileostomy bag and an affair and... I think there's GDPR issues here even before anything else.... 😳