I agree with @flowery it's important to remain factual about what actions the OP can usefully take otherwise they will spin off on numous tangents that don't help.
Huge GDPR breach, definitely pursue this
On the GDPR data privacy issue, on what basis can the OP "pursue this" that's going to make any difference whatsoever? Fact is her employer is a nasty bully and now her new job offer has been withdrawn, probably a blessing if it means she can cut ties with that vile situation and make a fresh start.
It's a "pick your battles" situation where citing GDPR legislation to the agency will likely be met with blank stares and making a complaint isn't going to get her closer to getting a new job! 99% sure ICO wont consider it a breach anyway and they don't pursue isolated cases that have minimal material losses or harm.
Far better to channel energy towards:-
(a) ensuring her employer fully meets their legal financial obligations and
(b) presenting their up to date CV to several agencies so they can prioritise suitable contract/temp and perm work opportunities for the OP
Anything else is a waste of time and energy at this stage!