The wording in the article "[t]he breach would violate the GDPR" implies that the act of the whistleblower leaking the information IS directly the violation...
I'm a fan of whistleblower protections, but if there isn't anything reasonably interpreted as illegal on the safety front, and he shared everyone's private information creating a violation of the law, then he should obviously face legal consequences without any extra protection whatsoever.
I am struggling to even see what the whistleblower intention is really. He leaked a seven year period of drive assistance complaints and it was just 4,000 (this sounds like a surprisingly small amount of complaints for a layman like me). Was Tesla hiding this in court cases? Were they not following regulatory reporting requirements?