Not allowed by EU law obviously. Role of courts (in general) is interpreting law and thus deciding how said laws apply case by case. Law in EU flows down from EU treaties that where negotiated and signed by member countries. The big ones (treaties) needed also be "ratified" by country wide referenda.
So it's just another thing allowed by a person. Law isn't something magical with capability to make something not okay okay. Law is just someone allowing or forbidding something, with this having been incorporated into a sort of system.
A sensible world would have lots of referendums with the general public approving or disapproving of parliamentary decisions, à la Switzerland, but that is not the world we live in.
The reality is most people don't want to think about governance all day every day, so we hire people to do it. Key thing is that we hire them.
I do not feel heartened by this sentence, even though I should be. We're choosing from a pre-curated menu rather than truly "hiring" representatives. The real power lies with party gatekeepers, donors, and institutional barriers that determine who even makes it onto the ballot, not with voters making the final selection. It's more like being asked to pick your favorite from two restaurants that a food critic already chose for you, rather than having genuine choice over where to eat.
Sure, power isn't evenly distributed and there are some obvious improvements we should pursue, but this does not a North Korea make
It's a bit like saying 'so make your own Facebook', but that's pretty useless if it's a response to someone who feel that some big social media company is influencing public discourse and harming proponents of certain ideas.
You can't make your own Facebook, or organize a political party other than in response to slow phenomena, and here we're talking about something has until recently been seen as literally illegal-- against the founding principles of the EU, so this is a huge, sudden change which people have no chance of resisting in a representative system.
No they don't get elected to the highest offices in the land (nor should they), but you can absolutely work your way there from a clipboard.
You are basically chosen by parties and other entrenched organizations. New parties are very unusual.
However, none of that really matters. Democracy, laws, etc. don't make this kind of anti-privacy policy more legitimate. If you create a STASI, it doesn't matter if you do so democratically, and that really is what we are talking about.
With software on your phones controlled by others going through your stuff you have a beyond-STASI-surveillance level.