Another (to me more plausible) option: The employee was unable/unwilling to separate the personal from work. So the "personal" data included (or could have reasonable suspicion of including) employer data.