> The rules on this vary across Europe

Not really, ECHR has already ruled on this.

It's pretty much only allowed if there's an important reason for it. For example, to recover something invaluable (contract, code, report) that isn't available somewhere else and cannot be replaced. In that case that's also the only thing that them employer can look for. They can't open obviously unrelated e-mails. So before talking to legal, make sure you have a valid reason.

What mechanism is there to prove who looked at what emails? And who would be there to enforce it, especially at a small business?

Difficult, very difficult on deed. As with most corporate and whize collar crime, the investigation rate is extremely low. That being said, worker councils and unions. The former has to involved in these things, if the exist. The latter pushes for the former.

That is valid for Germany.

There really is none. A smart company would work with the 4 eyes principle though (still no guarantee).

However, if a company does find an unrelated e-mail they want to use against you (which is what most people fear), that makes them liable.