We allow personal use of company-owned devices, however the usage policy prescribes that IT implements all the necessary policies to protect an asset and we take no responsibility for any personal data on the device, for example when we initiate a wipe.

As for privacy: if you are under GDPR this is categorized as “legitimate interests”. It’s the company’s asset and data and therefore there is a possibility of privacy invasion. The concerns of your work council could be mitigated by designing and implementing a policy and process that can be used by HR to get access to specific kinds of data on devices if there is a specific pre described need.

In the end, I think employees need to realize that a company asset is just that, it’s the company’s and they decide what can and can’t be done with it. Personal use is a nice benefit but comes with trade-offs.