Office monitoring code 'too vague'