At least in EU that clause is not binding, if you sign the handbook (or a contract) agreeing to it, that doesn't give the employer permission to do it - there are multiple precedents with GDPR fines for employee monitoring despite doing what you proposed.
Putting it in your employee handbook means acknowledging (in writing) that you have an illegal, prohibited policy, and getting employees to agree to it doesn't make it permitted.
There's no need to perish on that hill or confront anyone, a report to the local data protection agency should suffice to get it investigated and corrected, although it may take quite some time.
Putting it in your employee handbook means acknowledging (in writing) that you have an illegal, prohibited policy, and getting employees to agree to it doesn't make it permitted.