It doesn’t remove the “right to the protection of personal data concerning him or her.” The law cannot be random, it must ensure “fair processing” and be limited to “specific purposes”, and the European Court of Justice as well as the ECHR will decide what constitutes a “legitimate basis” in that context. Furthermore, “Everyone has the right of access to data which has been collected concerning him or her”, which ensures transparency of what is being collected.

Last but not least, a number of EU countries enshrine https://en.wikipedia.org/wiki/Secrecy_of_correspondence in their constitution.

Secrecy of correspondence only applies to sealed physical letters, so it has zero applicability to this law and provides zero protection against scanning of private messages.

Also it isn't respected in most types of criminal trials. If a sealed physical letter is opened and proves fraud, for example ...