Curious what comes first: actual spying to find out whom to fire vs. finding all information on an employee who is on the firing list? I think it is the later.

Curious what comes first: actual spying to find out whom to fire vs. finding all information on an employee who is on the firing list? I think it is the later. And collecting information (through IT) gets them to all the browsing information on the phone. Another aspect is getting caught in an IT system triggered alert. Typically being non-compliant with company sensitive information. This is not only at Google, but most big companies. Hence I am curious.