How do we keep network security monitoring from becoming employee surveillance?
By fixing the purpose, the data and the people with access before you start, and writing it down. State the purpose as detecting attacks on devices and systems, and exclude performance or behaviour monitoring. Collect metadata only, keep it for a defined period, and limit access to the few people who handle security, with a log of what they do. Tell employees what is monitored and why, involve the works council or employee representatives where they exist, and carry out a data protection impact assessment if the processing is likely to be high risk. Review the set-up once a year. NetSenX supports this by design: it watches devices and connections, never decrypts traffic, reports AI use per device and program rather than per person, and keeps an audit log of who did what in the account.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.