Theres no law regarding passwords. Only law that exists applies to personal details, but a password is not a personal detail. Since the password is often selected by the end user, under EU law this will Count as consent too, so even if someone would enter personal details as their password, it would Count as consent.
Depending on what the password protects, there might be security standards that laws will recongnize, for example Credit card details are protected under PCI DSS, Health information are protected under HIPAA, and so on. There also EU laws mandating how personal details should be protected. Those might mandate that passwords should not be stored in any recoverable form.
However, its a bad practice to display passwords like this. However, depending on what the password protects, it might not matter anyways.
One example is that all passwords are visible to a administrator, so a administrator can log in as any user. This might be a way to solve that some systems does not have "Takeover" capabilities where a admin can log in "as" any user.
Another way can be that the service being protected by the password, is also protected by any other means, like a firewall requiring a VPN dial-in Before allowing access to the protected service. And the password protection on this service are then not compatible with Single-sign on solutions or similiar, why the Company behind, simply show the password to login to This protected service, because even if the password do leak out, its useless to a attacker who do not possess the other means requiring to reach the protected service (like the VPN dial-in details, certificates and any OTP tokens).
If the passwords are to workstations in the Company in question, and those are physically protected (eg to reach the rooms where the workstations are located, a access card swipe is required anyways), then it wont matter if the passwords are shown anyways. You still need that access card to do any harm.
There also might be that this password does not protect anything valueable anyways, they just want a light protection on the web site to prevent general public access, but the information is still safe for the public to view, but if anyone hacks the website, no harm is done anyways.
Example: Product manuals available to customers of the Product. If those leaks out, it wont matter anyways.
Do a judgement if the information on the internal website is sensitive, eg "What happens if any unauthorized indivual accesses this website", and act accordinly. If the information is sensitive enough, you might want to report this to some security responsibile or something.