Is an authorised employee who emails clients' personal data to their private email address a trusted recipient?

ANSWER

Such an incident should certainly be treated as a breach of internal procedures or an infringement of the GDPR, but should also be considered in the context of a possible personal data breach, as it may lead to personal data being disclosed to an unauthorised recipient — the email service provider handling the employee's private mailbox. (In other words, the employee remains a person authorised to access the data, but sending it to a private address may result in access to those data being granted to an unauthorised recipient, i.e. the email service provider.)