Wife (England) received confidential data from colleague based in America

My wife has been emailed confidential data from a colleague in America.

Her understanding is that sharing this data violates GDPR in England, but doesn't violate any law in America.

1. Since her colleague is under American laws, would they be found to have done nothing wrong even though they shared the data to someone in England?

2. If my wife has received the data in England, does she need to report a data breach even if the source of the data hasn't violated local rules?