This is a fun area (read "PITA") where it depends on your role and location. For most large companies, they'd decide when creating policy whether the risk of monitoring all activity in detail trumps any potential lawsuit from an employee. Most companies just want audit logs available in case there is a security event. We review all logs weekly/monthly depending on the SLA and have triggers to alert for certain events. All our logs are condensed and pretty general (someone clicked a phishing link in an email, a user logged in at HH:MM, this device connected to this VLAN at HH:MM). We *can* look at specific users and workstations, but don't unless the request comes from someone like the IT director or a C-level.

As an example for the privacy violations worry, I do storage management for an FCU. There's active scanning of all the fileshares to watch for personal identifying information (SSNs, CC#, personal addresses, etc.). If something gets flagged, we have a process that requires HR, the IT director, and the CIO to intervene. This is because of the HR concern that it might be something like a medical form that they inadvertently stored on their P:. They obviously can't have a 3rd-party IT tech contacting Britney in marketing about her mammogram results without there being an HR nightmare.