They kind of have one. The charter of fundamental rights of the EU contains privacy protections that has been used to shoot down at least the data retention directive and IIRC the EU-US data transfer frameworks.

It’s possible that the CJEU strikes down a chat control-style law based on that charter, but preferably we don’t have to test that.