This is a wild exaggeration. Again, GDPR is not relevant here and private communication on the employer's infrastructure generally caries no reasonable expectation of privacy, at least in the US, double more so when you are actively sharing that email with your team.