A clause to the effect that &quot;no expectation of privacy&quot; is to assumed, would be null and void most places in Europe. That does not mean monitoring it not allowed, but there are substantial carve-outs.<p>E.g. in Norway (which does have some of the more extensive privacy protections), the general rule is that surveillance of employees personal e-mail etc. is outright illegal, there are substantial restrictions on monitoring web usage, and that employers right to access an employees address <i>on the employers mail server</i> is also limited, and can easily violate privacy laws.<p>Generally, for an employer to access employee e-mail addresses, there needs to be a compelling need (this could be as simple as needing access during an employees vacation, so it&#x27;s not like it&#x27;s safe to assume employer will never have reason to access it), or suspicion of serious violations of employment terms or laws (e.g. your child porn example would certainly qualify, as long as there&#x27;d be some evidence to support the suspicion; as would e.g. collecting evidence following claim of harassment of co-workers or similar).<p>In terms of web access, since most of these rules are based on privacy laws, you can typically do generic monitoring e.g. of sites being accessed, but run into problems if you tie them back to individuals. One place I worked they dealt with extensive access of porn sites in working hours by publicly posting a list, with a warning that it needed to stop on grounds of concerns over harassment etc., without collecting any data on who accessed what, and access dropped drastically, and that was that.