In principle, yes. In practice, no. National security is a matter of the member states. Note that the right to privacy is also in the Dutch constitution. From the little I know, the oversight mechanism in the Netherlands seems to be working to some extent but there are still plenty of caveats:

https://aboutintel.eu/ctivd-bulk-datasets-held-by-intel-need...