>From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it.

How often did that stop an employer?

I don't know if this is the case in the US, but in Australia it's very easy (and relatively cheap) to take your employer to tribunal over violations of employment laws (if it was very clear-cut or severe violation you could even make a complaint to the relevant regulator which could launch an action on your behalf). Something being illegal means if they did do it, you'd be owed compensation.

If you live in a civilised country, it is illegal.

At least in the EU, it's illegal yes - https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...

From the article: The only thing they did wrong was not more explicitly mention the monitoring. So it wasn't illegal to monitor communications, rather it was illegal to fire someone for using their work account for private communication without sufficiently warning them. All they have to do is make you sign some document on day 1 and they're covered. Also they were not awarded any damages or anything, so it's not like you'd get a payday after being fired.

>Commenting on the ruling, Pam Cowburn, the communications director at in London, said: “The European court’s ruling is welcome. In some workplaces, it may be necessary for emails to be monitored, but if employers are going to do so, they should make staff explicitly aware of it.”

>Despite finding that Bărbulescu’s rights under article 8 of the convention had been violated, the court declined to award him any compensation, saying the ruling was “sufficient just satisfaction”.

It's definitely NOT illegal in EU if the user is appropriately informed, usually in your employment contract you sign a clause about that. Even the government does it to their employees.

No, there have been all kinds cases of enforcement action in EU where the user was informed but the employer could not justify the violation of privacy; in general EU law and especially in privacy law it's quite frequent that some explicit "consent" clause in employment contracts (essentially, if it's a standard clause in all agreements and "take it or leave it") is treated as not representing true consent and void.

The largest example probably is the 2020 GDPR fine of 35 million euro for clothing retailer H&M for violating the privacy of their employees, despite the employees being informed of that.

What you're talking about has absolutely nothing to do with tracking usage of workplace computers and networks - H&M kept "excessive" (sic) records of personal data of people who were not their employees at all (family members of their employees) - and the problem wasn't that they had some data because in EU you're required to keep track of families of your employees due to tax reasons, but that they had too much of it.

In most EU countries, tracking company-owned hardware is explicitly okay, and where it's not mentioned in law there are judicates that make it OK.

As I said, even the government and its wholly/partially owned enterprises are doing it, and working as a contractor for the government here requires you to track usage of your employees' workplace computers too, so I can't see how it could be in any way illegal. Same thing with working for banks and insurance, and I bet there are more cases.

In The Netherlands, employees enjoy a reasonable level (much stronger than this scenario) of privacy even on company equipment [1]. That is: the company cannot randomly access an employee's mailbox. Of course, in case of employer-employee dispute, things become hairy - but even then, the company is not allowed to go on a fishing expedition. Though they can go on a confirmation run, looking for specific evidence, e.g. mail from Glassdoor.

Don't know about other EU countries, but at least NL deviates significantly from the sketched scenario.

[1] https://blog.iusmentis.com/2017/11/22/wanneer-mogen-mailbox-...

> Not for everyone.

Still cheaper then searching for a new job... without a current one.

Disagree, with the money I would be awarded from my employer for their breaking of both employment and privacy laws I think I could easily purchase a new laptop - and also fund a few months of vacation while searching for the next job.

(This probably doesn't work so well in the US.)