It's my job to know what the fuck people are doing with our computer systems and if it's a threat. Using work systems for personal business is grounds for termination. Revealing sensitive company information to your therapist via company email... also grounds for termination. etc.
Just like it's my job to know if they are looking at porn on company computers. I live in America. GDPR doesn't exist there and we don't do any business in Europe.
I'm glad you want to protect idiots from themselves. I don't. My job is to protect the company from idiots who are doing stupid shit they shouldn't be doing that may lead to our systems being compromised. kid should have done his banking on his personal cell phone and he might not have been fired. we even offer out of band wi-fi for employees to do shit like that...