> Thankfully not true in sane countries.
I'm not so sure about that. Do large-enough French companies supply their own Certificate Authority to all company computers (like all large corporations)? If so, then they're free to browse/search/store all https communications from any company machine, right?
The assumption is that employers and IT departments will always "follow the rules", but it's impossible to verify something like that. The way corporations would be "caught" would be from huge numbers of whistle-blowers but that's a risky career move for most IT workers.
The good news is IT departments and individuals generally don't care to spy unless there's something really high-value at stake and only then towards very specific "targets". With few exceptions, the vast majority of workplaces tolerate ordinary personal use of corporate computer resources.