I hope you are not suggesting company policy trumps the law. This kind of stuff has come up before, including company-authorized personnel accessing employee medical records, which when discovered had the employers try to hide behind even company monitoring policy. It doesn't work.

For just one example. Employers have a right to monitor employees phone calls under a set of conditions, however if a reasonable person would recognize that the call is of a personal nature and does not involve the company and/or clients, the employer is not entitled to monitor the call and is certainly not allowed to use that information against the employee or even to access the employee's information off-site.

If you are not even familiar with US federal law on this matter, then I suggest you become familiar with it and also research relevant case law and legal determinations made by government authorities in the US and numerous other countries. With regard to the US, unless the employer has informed the employee that there should be no personal use whatsoever of company facilities, including phones and other communication equipment (and for this purpose computers using the internet would qualify) and done a few other things, the employer and employer-authorized parties are legally prohibited from monitoring employee's obviously personal communications (even if making reasonable use of company facilities) and/or then using that information to access non-employer-/non-client-related external information about the employee where that information is located external to workplace facilities.

[This kind of employer monitoring of employees is even more expressly legally prohibited in other countries across the planet, but I'm not about to spend my uncompensated time doing work for others here just to clarify their dangerous misconceptions that leave parties legally exposed to civil liability and even criminal prosecution in a variety of circumstances.]