It is not surveillance, it is transparency. IT support people are in a position of power where they have access to a lot of personal information, and the users

It is not surveillance, it is transparency. IT support people are in a position of power where they have access to a lot of personal information, and the users should definitely know if there has been a data breach. And somebody getting access to things like bank records of home-made personal porn definitively is a breach. Ideally, they should not be in a situation where they can access any personal file without the owner being present.