what is the best approach to handling the expectation of privacy by employees in the event an investigation needs to be carried out on company-owned digital assets?