The case highlights growing tension between Brussels’ privacy rhetoric and the EU’s expanding security apparatus.