You've posted in 'Law' so I'll start with a 'legal' response with regard to the manager. The Data Protection Act makes him (and his employer) responsible for ensuring that confidential information isn't leaked so, technically, he's 'wrong'.
However a more realistic response is that everyone makes errors. The world's best surgeon's, for example, will all make some mistakes during their careers, resulting in the deaths of some patients. The manager made a single (and hopefully isolated) error and it would seem harsh to blame him too much.
The member of staff who disseminated the information though was clearly 'in the wrong' as he/she took a deliberate action to pass on what he'd read.
However, in the real world, other staff will have noticed your son's punctuality problems anyway, and could almost certainly have guessed at what the outcome of the review would be, so your son's work colleagues haven't really learnt anything new.