[BartjeD]

That's not true, because there is a hierarchy of legality.

If a principle of the EU legal order is at stake, such as the right to privacy, then that constitutional imperative can very well override a new law.

The commission and parliament are well aware of this risk. They often choose to have laws advised on by the courts, in advance. To avoid a legal mess.

This is normal in a functional democracy. To avoid abuse of power / overreach by any institution.