The fact that it's done doesn't mean it's allowed (and this is very true in Italy, unfortunately).

Monitoring the connection of an employee (which is different from blocking certain domains) is possible under certain conditions, but always at the individual level and when there is a reasonable suspicion that the employee might be misbehaving: https://www.laleggepertutti.it/507663_controllo-navigazione-...