I can tell you a long and deep story on this topic. Our own company policy prevents this under conditions and circumstances, our own policies are also mutual to our SLA’s, thus we treat our internal environment the very same as with our customer’s ICT environment. This is but one ethical business standard we implemented.
There is various laws, stating privacy, the domain and e-mail address may belong to your company, but not the personal content to a certain degree. They will need legal obtained access to their employee’s personal data. I’m not about to go into depth with laws, policies and their clauses, but someone with a law background can check this, ask Michalsons on MyBB. Remember, the employees also utilises the company paid internet in regard with their personal activities, so they should not be doing anything personal at all, time to look into the group policies.
Back in the day when I was still a network administrator, the company let me go due to me not providing the personal details they requested on a certain employee.