From the GDPR training I did for working as a software engineer in DE, this is all OK as long as its legitimately required for compliance, explicitly disclosed to the full requirements of BDSG/GDPR and not used for anything other than the stated reasons.

This is a huge contrast to the US where it would likely be completely legal to look at this kind of monitoring and then fire someone under at-will employment law for reading too much news.ycombinator.