Balancing oversight with employee privacy