>>techbi+(OP)
That's definitely a question of implementation, policy, compliance, and liability. You are absolutely correct.
The law in question also requires data to be maintained in personally identifiable form. I am uncertain if a small number of mouse movements is likely to reach this. I do not see how, but that's not a reason why it cannot be so.