This is legal for most businesses under US law, especially on company devices. And unfortunately not unheard of. Compliance with this data is typically handled in the same way you'd handle any data access situation -- by restricting access to the screencaps to a specific group of people.

Not that I support it -- but typically companies don't do this in spite of security concerns, they do it to address security concerns. But of course, what meta is doing sounds like a different situation. It sounds like they want to make a model that replaces part of their workforce.

I understand the security spyware, though I think it's somewhat questionable there. But this sounds like deliberately putting all of your most sensitive data in a blender and then inevitably letting anyone get a taste of the smoothie.