The company can easily take measures to prevent situations like this by using a proper CRM solution. If the company didn't, it's its own fault. Flaws in internal processes don't legitimize surveillance.