Yes; they could amend the definitely-not-a-constitution (for branding/eurosceptic-appeasement reasons, the EU constitution was rebranded as the Lisbon treaty before adoption). Arguably such a right may exist already and this legislation might find itself on a collision course with the ECJ if it passed (notably the ECJ nuked _another_ intrusive law, back in the day:
https://en.wikipedia.org/wiki/Data_Retention_Directive).