To the extent that they're collecting personal information, if their use of that personal information they're collecting is consistent with the purpose for which it was collected.... Monitoring keystrokes is the same as looking at the document you've typed. If they're using the document for a purpose that's consistent with why it was originally created, then it would qualify for the exception. If they're using those keystrokes in some completely unconnected way, it's inconsistent with the original purpose, it wouldn't be permissible under the exception. If they were doing it in a manner that a court considered unreasonable, in other words it wasn't fair, it didn't demonstrate a use of good judgment, if it was patently unreasonable then the exception wouldn't apply either.
On April 21st, 2015. See this statement in context.