It clearly states here in 2 “consent of the person concerned OR some other legitimate basis laid down the law”, any random law will trump personal consent

One of the reasons international human rights law is so worthless in actual practice, is that half of it is framed like this. "Everyone has the right to X, except as duly restricted by law." Cool, so that's not a right at all then.

Ditto the Canadian Charter of Rights and Freedoms, with its 'notwithstanding' clause. (Though they're presently litigating over that, so we'll see what happens!)

Any constitution or human rights instrument full of exemptions, 'emergency powers', 'notwithstanding' clauses, or 'states of exception' is not worth the paper it's written on.

It doesn’t remove the “right to the protection of personal data concerning him or her.” The law cannot be random, it must ensure “fair processing” and be limited to “specific purposes”, and the European Court of Justice as well as the ECHR will decide what constitutes a “legitimate basis” in that context. Furthermore, “Everyone has the right of access to data which has been collected concerning him or her”, which ensures transparency of what is being collected.

Last but not least, a number of EU countries enshrine https://en.wikipedia.org/wiki/Secrecy_of_correspondence in their constitution.