There are certain protections against the government of the day taking away fundamental rights with a simple majority. In the EU, these constitutional principles are enshrined in the treaties that can only be changed unanimously.
On that basis, the highest EU court (CJEU) has ruled several times that mass surveillance is unlawful. Governments are still trying to find a way around these protections, but it's not a certainty that whatever ultimately passes parliament will hold up in court.
What you failed to mention was that the rulings against data retention for example which were indeed invalidated by the European court happened 8 years after the fact.
So what do we do for 8 years while the courts decide which side is right?
On that basis, the highest EU court (CJEU) has ruled several times that mass surveillance is unlawful. Governments are still trying to find a way around these protections, but it's not a certainty that whatever ultimately passes parliament will hold up in court.