Companies are not homogeneous blocks of matter and there is always information some people at the company may need to know that others have no business dealing with. Tax, banking and health related information are some of the things that I can think of that would be shared on a need to know basis with people at work and have no business to be seen by people outside of the intended audience.
I am against workplace surveillance, but why would people receive this information to their work email address?
I'm not aware of any EU wide laws that prevent what you're talking about here. In the UK an employment contract will state that the employer can monitor your activity if they need to and this is completely legal.
Source: https://www.gov.uk/monitoring-work-workers-rights
In some countries (Germany springs to mind) there are much stricter rules. A blanket statement like the one you've made here is not correct unless you're being very specific about where you're talking about.