Has she had the interview? It’s not uncommon for “contacts” to reach out unofficially when confirming their choice for a job, I know ex colleagues/managers have vouched for me in my days in the private sector.
If it’s pre-interview, then there’s no reason for that info to be leaked and spread that way. That’s a big issue of trust and confidence even if it’s not an actual GDPR breach. Would I want to trust the new employer going forward with any private issue, eg health issues?
If it impacts how she is treated by her current employer, I’d be keeping full records as that breach of confidentiality is impacting her career and potentially health.