I'm not aware of any law that prohibits it.
Many people believe that they have far more rights to "privacy" than they actually do.
That is not to say that I think it's okay for an employer to give out this information. But as far as I know, he hasn't violated any laws by doing so.