It's strictly forbidden by law and only allowed in very constrained circumstances when the employer has a strong suspicion ("Anfangsverdacht") that the employee is doing things they aren't allowed to. Even then the work council has to be informed and a representative has to be present to ensure no laws will be broken and privacy is preserved.
In the financial industry, it is strictly forbidden by law to miss reps talking to customers from their homes, on their personal devices and accounts. Banks are in the news getting fined for this routinely.
But they're not snooping on your personal devices at home, so this wouldn't even catch that.
I had to spend time in front of them to literally beg them to let us install an EDR (and heard similar stories from others).
At some point I said fuck it, we will disconnect this country and they will have problems.
This helped me to understand that the work council is the last to fall with people routinely working to there, so they do not care. Also Germany of too big of a country.
The net effect is that some projects do not go there anymore because of the complications.
Note 1: the installation was for security reasons. They had a security problem once and I was calling the work council on daily calls (twice a day) to show them that I can be a pain on the ass as well (it was in the contract we signed with them). Calls were at 8 and 21.
I hope they understood a bit why I was asking for the security measures.
Note 2: I am grateful when they ( and the ones in my country) fight for employees protection. This is great to work in such a country. There is however a moment where they lose content with the reality.
I think there is false dichotomy that all monitoring is bad.
Yes if they come to you and nag about browsing hacker news because they found out you are slacking here and there it is totally overstepping.
If company decrypts traffic and has automated scanners to find out/block malware/bad sites I don't see an issue with that.
To explain it in plain words: It's not acceptable because I have a human right to privacy.
Yes, privacy allows people to "hide" stuff. It's not an overriding thing. Employment relationships, like rest of our society, are largely based on trust and respect.
The last corporate IT job I had, they expected me to use my personal cell phone for job-related tasks. No, I didn't want their malware running on my phone, nor did I want to upgrade to an expensive cellular data plan for the required connectivity. If they wanted me to have a phone for their business, they should provide one.
Management and HR were quite upset. I suggested they check the state Labor Board. Shortly after, I was given a purchase authorization to buy a company phone and service.
Also, if this is a legit concern, you may have a hiring problem (or you work for .gov or on .gov contracts exclusively.)
A better an analogy would be a desk phone. Does the employer have the right to record phone calls if an announcement is made to all parties?
E.g., in the US, you have a right to not have your picture taken indoors, but outside in public spaces you don't have this right.
You have a right to do more or less whatever you want with your personal laptop, but your agreement with your employer generally implies that you should only use a work computer for work tasks.
I am not trying to trap you. I am genuinely trying to figure out where the lines are.
Edit: I just want to add that I however wouldn’t agree with or work for a company that monitors my work computer to make sure I’m always ”working” (taking screenshots, tracking mouse and keyboard etc).
Somehow most people understand that swimsuit is appropriate on the beach and on the swimming pool and not in the office.