Might be boilerplate in the US but it&#x27;ll vary from country to country in the EU. Certainly Germany had very tight rules on this kind of stuff.<p>Also at a previous employer (multinational, 30+ countries) the CIO took an explicit decision not to employee any kind of technology that could &quot;spy&quot; within SSL traffic to avoid potential liabilities around company IT staff having visibility of personal banking details etc.<p>Also, just because something is in an employment contract or handbook doesn&#x27;t mean it&#x27;s enforceable.