My experience in the same kind of setup is that such an upgrade comes bound with all kind of modern workplace surveillance tools (hello Zscaler and SSL terminat

My experience in the same kind of setup is that such an upgrade comes bound with all kind of modern workplace surveillance tools (hello Zscaler and SSL termination), so the pushback is actually very much warranted under European customs/laws, even though misjudged from the US/management side.