If I give you a free email service and you agree to the terms that I can read then I can do that and that is equivalent to doing what I like in the context of what we are talking about. Besides, there is no obligation for any company to provide email privacy and anybody who thinks that there is some law where they must provide this fabled privacy is a fool. The reality is that they can practically do what they like because the user agrees to their terms - terms that their very expensive lawyers will have indicated to them if they will fall foul of the law. Very little chance they will fall foul.
Scan is the exactly the same as read. They are "scanning" with program that looks for certain phrases or perhaps URL's and then adds it to their data warehouse for example. They automated it all so they can pretend that scanning and reading are different. The program or programs that "scan" really do read every last character that passes through Google systems. They say scan to trick the naieve people.
Google has massive expertise in this "scanning" and will extract URL's with ease. Trivial to profile people who register at certain sites and then add them to a list where all the URL's that pass through their email are added to a manual scan list for example.