Many collect evidence for something after the fact. "We don't look at the data unless something has come up, because it would be a privacy violation otherwise". Which is pretty much how police is supposed to work in normal life either way.
That is still violating privacy laws in EU, potentially. You cannot even give a blanket agreement for "work related" because that does not hold under scrutiny due to simple employee mistakes. You would be collecting more data than agreed upon.
