If he's actually working for the company--as seems to be the case--then it's not a privacy violation. You should protest.