It’s not that cut and dry is it? It depends on whether or not the employer allows personal use of their internet/email infrastructure. If not, and if the user doesn’t have a professional responsibility to handle data that’s protected, employers are legally permitted to view the content.

https://www.mofo.com/resources/publications/employer-surveil...