You are correct, employers are allowed to block e.g. Facebook (most have given up on that though). But never read or act upon their email&#x2F;connection data&#x2F;... in a semantic way. 
I have no english source for this, sorry.