Not to forget the European Human Rights Convention as interpreted by the European Court of Human Rights (ECHR), although it's not an institution of the EU but the Council of Europe, spanning all EU states and then some.

The Court's case law is recognized as is by EU, and includes some landmark privacy rulings, e.g., against access to contents and metadata of electronic comms without a court order (or comparable legal safeguards), or any forms of bulk surveillance.