That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company

That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.