It would be an invasion of privacy if he did it without consent and there was an expectation of privacy. I would suggest that he talk with a cyber lawyer. While there is "technically" no privacy laws in the US, I suspect that one could probably extrapolate the idea of privacy from opening mail (ie., email)