We have a Data Protection Officer who is quite senior; and should, on paper, know the intricacies of EU/UK Data Law. However, they often make questionable choices that are challenged by other colleagues, many much more experienced than the DPO.
Our DPO is also our CISO, and in response to a single employee (out of thousands) potentially exporting PII (accidentally) to a personal device, has asked for a policy that I find intrusive, and concerning. The CISO/DPO is notoriously dismissive and usually doesn't reply to emails/phonecalls; so before challenging the policy I would like to be sure of my position.
The request is to create a mail-flow monitoring that would capture any emails sent externally containing a photograph, and BCC them into a mailbox monitored only by the DPO/CISO. Our employees would not be aware of this activity, and we would not be able to audit what the DPO/CISO has/has not seen in this mailbox (limitation of the technology).
Not only do I find this intrusive, I find the response entirely disproportionate to the actual incident.
On what grounds, if any, do I have to challenge the intrusiveness of this?
Are employee's entitled to any reasonable right to privacy within an organisation, within this context?
N.B, I do not have the option of approaching the DPO/CISO and discussing directly.