From my understanding, while not illegal, it is a very , not to be rude but, unintelligent practice. I can't speak on GDPR or foreign laws as an American. I've seen protected information sent via email, for example an email sent to my mother in which I was asked to look at, contained sensitive data and include an NDA covering the contents of the aforementioned email. That doesn't mean it is an intelligent action. Not to speak in an insulting tone, but I mean objectively. I noticed you stated the network is "internally".
If the email server is configured properly on the server, the practice should be as secure as storing the files on the company's computers and servers. If the data is as confidential as you say, chances are the email server is encrypted and possibly only transits mail to internal relays defined by either certificate validity or whitelists. This would be the same if everyone at the company used something like FTP to connect to remote storage instead.
If you mean cleartext as in the emails content look like this post I'm writing, that could be misleading. Cleartext is referring to the underlying data. I may be confusing something, but I don't know your technical knowledge, so I figured I'd make this point. Just because the text appears normal client-side, most email servers that are properly configured use encryption for transferring data via relays, securing the data from client to server, just like HTTPs.
Your question is a little confusing, since you say "to customers" and "internally". Internally means it says all within the private company network. However, saying it is sent to customers makes me think it is send externally, to addresses like "[email protected]". If you do mean that the data is sent externally, then while I don't believe it is illegal, it is quite irresponsible and (not to be rude) stupid. Companies like Google are well known for the fact that they read every bit of data send and received by their users, including these emails containing sensitive data.
Your question in terms of technical specificity makes it hard to answer. If you are concerned about the security of information in transit, it would be smart to bring it up with the technical department. How the underlying systems are configured for a purely internal network is important. If the emails are send externally, then I strongly am against sending sensitive data via email. Instead, store the data on a secured server, and send a link to the user, so that they may click it, on the server be authenticated and have their identity validated, then present them with the information.
Please reply to me if I misunderstood your question or such, and I'll try and append to my response.