I suspect that at least in the US, its probably not illegal to do this in a business, especially if it is spelled out in the employment contract that they have the right to monitor all communications.