It's more like "Read this 50-page employee handbook and send us your signature acknowledging it. You must do this every year." (It is the mostly identical to last year's version but with the employee monitoring added to a clause, and we aren't mentioning what's changed)
At least in EU that clause is not binding, if you sign the handbook (or a contract) agreeing to it, that doesn't give the employer permission to do it - there are multiple precedents with GDPR fines for employee monitoring despite doing what you proposed.
Putting it in your employee handbook means acknowledging (in writing) that you have an illegal, prohibited policy, and getting employees to agree to it doesn't make it permitted.
There's no need to perish on that hill or confront anyone, a report to the local data protection agency should suffice to get it investigated and corrected, although it may take quite some time.
We've been hearing authoritarian minded people for years saying things like "actions have consequences" and "you had a choice, no one forced you to" but coercion (pushing someone to an unwanted choice using an imbalance of power/threat) is simply an illusion of freedom and fairness.
