Under data protection rules, your employer is required to tell you in advance if they are going to monitor your use of the internet or the email system (and the reason why they will be carrying out the monitoring). Sensible employers will have a policy that allows staff some personal use of the web.
Your employer is only allowed to use covert monitoring (i.e. monitoring which you are not informed of) in very rare circumstances, e.g. where a crime needs to be investigated.
If your employer has failed to inform you that you are being monitored, speak to your union rep if you have one. You also have the right to complain to the Information Commissioner. In any event, it is always sensible to check out any workplace policies before using your employer’s electronic systems.
Even though your employer may have broken data protection rules, this probably won’t prevent you being disciplined if using the work internet for online shopping is against the rules where you work, especially if you are shopping during rostered work time. Check whether your employer permits you to use email or the internet for personal reasons such as shopping.
Your employer should have clear rules in place telling you what use can – and cannot – be made of the internet at work, and what punishment is likely if you break those rules. Sometimes personal use is permitted but at specified times, for example only during your lunch break. If the rules are not clear, it would normally be unfair to discipline you for breaking them.
The Information Commissioner has issued guidance advising employers to prepare workplace surveillance policies and to consult staff when doing so. This guidance can be found on the Information Commissioner's Office website.