Ask HN: Employee location tracking and GDPR/data protection

My employer (in the UK) has taken a hard stance on RTO, and they're tracking it with in office day % targets at a team level.

They have created a mobile application which lets you:

- see a map of all desks, which is clickable to show who is logged in at a particular desk, their name and photo and whether they are online/away/busy

- look up where a person is sat, or whether they are working from home

Any member of staff can access it at any time so it is starting to be used as a way to see how long individuals (as opposed to the team) are present and whether they are coming in for more than the required number of days.

My question is not so much whether employers can collect this data, but if they are allowed to share it with all other employees? I thought that this counts as "personal data" and there would be controls on who should be able to look at it.