Yeah but people are highly aware of it and there is even a disclaimer in Email Signatures that everything is tracked. If you are dealing with government ministries in European countries some of the (unofficial) information exchange is done without written record, either at in-person conferences or even through non-work phones.

Under the GDPR, employers in the EU can only monitor employees' work emails if it is necessary, proportionate, and serves a legitimate purpose, such as ensuring compliance or security. Employees must be informed about the monitoring in advance, and clear policies should be in place to respect transparency and consent requirements. Any monitoring must also balance the employer's business interests with the employees' right to privacy, ensuring minimal intrusion. Some countries like Germany have really strict interpretations of how to apply the GDPR here.