OK, that is what is &quot;legally possible&quot; in a worst-case scenario.<p>But IN PRACTICE, what is normal?<p>Your statement seems to indicate that IT staff can just browse personal communications, desktop displays, keypresses. I am sure that they can if necessary, but what kinds of scale and automation are we talking about? Doing such surveillance ad-hoc or without a very small number of targets seems like it would easily become intractable for any org with thousands of people.<p>I am not in an IT department, so I have no idea what goes on.<p>It seems the standard advice is always to take the most extreme precautions and to follow the corporate rules to the letter... but here I am typing this into a work computer on a chrome browser without a care in the world.