I think it's weird wording from legal. My guess is that the work laptop has security software preinstalled that routes traffic through a proxy that they can see, even encrypted traffic. So they're just collecting John's traffic for analysis