This is why I'm so surprised that other commenters are surprised. If you've ever worked for a Big Serious Company (especially the defense sector, but increasin

This is why I'm so surprised that other commenters are surprised. If you've ever worked for a Big Serious Company (especially the defense sector, but increasingly just about everywhere), they have an IT Security department, and that IT Security department has a data loss prevention plan. Part of that plan is endpoint protection software, and that endpoint protection software has to be a rootkit, by any reasonable definition of the word. I guess the crux of the problem is that the modified/redlined language might have made sense to the GP's friend at the time, and the HR person might have thought it made sense, but you can't tell the DLP software "no personal information" -- if there's an incident and the company needs to perform a forensic investigation, they can't be responsible for determining what they're "allowed" to look at. As other commenters have said, if you don't want your employer seeing your personal data, don't put that data on the same device as your employer's data.