That's the EU law position, but national law may not agree. I believe both France and Germany, for instance, consider their national constitution to be above EU law (even if the EU Court of Justice disagrees) - Though in practice the constitution was amended when necessary to avoid any conflict.

By the EU’s own definitions of coercion and harm, an attempt to impose mass surveillance by force over national objections would itself meet the elements of coercive intimidation against a population. If we took those standards seriously, it would trigger the very mechanisms meant to prevent terrorism.