I think that it is the Information Commissioners office that deals with this
They have a guide called "Quick Guide to the Employment Practices Code"
Section 5 deals with Monitoring at Work
Here are some extracts
If you monitor your workers by collecting or using information about them, the Data Protection Act will apply. This can happen, for example, when you video workers to detect crime, when you check telephone logs to detect excessive private use, and when you monitor e-mails or check internet use.
■ The Act doesn’t generally prevent monitoring. However, it sets out principles for the gathering and use of personal information. In short, data protection means that if monitoring has any adverse effect on workers, this must be justified by its benefit to the
employer or others.
■ The Act requires openness. Workers should be aware of the nature, extent and reasons for any monitoring unless, exceptionally, covert monitoring is justified.
Be particularly careful when monitoring communications, such as e-mails, that are clearly personal. Avoid wherever possible opening e-mails, especially those that clearly show they are private or personal. Monitor the message’s address or heading only.
■ If it is necessary to check the e-mail accounts or voice-mails of workers in their absence, make sure they are aware this will happen.
■ Where video or audio monitoring is justified, target the monitoring, where possible, at areas of particular risk, and only use it where workers wouldn’t expect much privacy.
■ Ensure that if you use information for monitoring which is held by third parties, such as credit reference or electoral roll information, you can justify this. Take particular care with any information you hold about workers as a result of non-employment dealings with them, for example where they are also your customers.
■ If you are justified in obtaining information about a worker’s criminal convictions for monitoring, only do so through a ‘disclosure’ from the Criminal Records Bureau.
■ If you monitor workers through information held by a credit reference agency, you must tell the agency what you will use the information for. Do not use a facility for carrying out credit checks on customers to monitor or vet workers.
I'm not sure if this is entirely clear, but it seems to be clear that the employer needs to be open about what they are doing.