Well, no - they do not have clear hands, in case the corporate policy allows to collect personal data. Not even if the authorized unit agrees.
There is something like law that forbids expressly the collection of exactly those data.
I don't know where you live/work but judging by your name I would hazard the guess: Poland. Let me tell you something: it's forbidden by the law to collect personal data (which work performance data are) without the consent of the respective user.
If you don't believe me, contact:
Mr. Wojciech Rafal Wiewiórowski
ul. Stawki 2
PL 00-193 Warszawa
who is the representative in such matters in Poland.
Why do you think, we make out authorizations in SAP as strict as possible? Why do we define emergency-users? Why do we apply all manner of security restrictions?
In order to AVOID having to monitor all "subjects". Because. The Law.