[raxxorraxor]

In my country this would be illegal without consent. That is also applying to devices that are only permitted to be used for work. But if an employee still uses it for private stuff like doing private transactions or logging into their private facebook account, it still will be a privacy violation if IT catches any of the private data. It still is protected data.

Doesn't sound intuitive perhaps, but the law is actually quite ingenious. Wouldn't have though someone would come up with it in our digitally third world country. These laws seem to be lucky accidents though.

Still, your assumption is the only healthy position to take nowadays, regardless of country or legislature.