"Article 7
Respect for private and family life
Everyone has the right to respect for his or her private and family life, home and communications.
Article 8
Protection of personal data
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority."
Ditto the Canadian Charter of Rights and Freedoms, with its 'notwithstanding' clause. (Though they're presently litigating over that, so we'll see what happens!)
Any constitution or human rights instrument full of exemptions, 'emergency powers', 'notwithstanding' clauses, or 'states of exception' is not worth the paper it's written on.
(That’s not to say laws shouldn’t make a better attempt to circumscribe exceptions)
Anyway, as far as human/fundamental rights go, the encryption and related issues in Chat Control tend to fall more on the Article 7 side of the Charter[2] like many similar questions related to different forms of (mass) surveillance, secrecy / confidentiality of (electronic) communications, including related national regimes with often diverse jurisdiction-specific histories, etc.
[1] The main difference between a Directive and a Regulation under EU law is that a Directive requires implementation on the national level to work properly (ie national legislation, usually with some room for discretion and details here and there), while a Regulation is directly binding and effective law in member states wholly in itself.
[2] And similar/corresponding language in the European Convention on Human Rights (ECHR), including the related case law of the European Court of Human Rights (ECtHR). While these are not EU institutions, European human rights law is recognized and applied as constitutional / fundamental rights-level law both by the EU and member state courts.
Last but not least, a number of EU countries enshrine https://en.wikipedia.org/wiki/Secrecy_of_correspondence in their constitution.
Also it isn't respected in most types of criminal trials. If a sealed physical letter is opened and proves fraud, for example ...
Germany, for exmaple, has secrecy of correspondence that extends to electronic communications, but allows for "restrictions to protect the free democratic basic order" and outlines when intelligence services can bypass the right to privacy.
Italy, France, and Polan also have similar carve outs.
Having it as a right isn't enough. National security and "public safety" carve outs need to be eliminated. So long as those exist, we have no right to privacy.
Article 7 codifies "respect for [one's] private life" and "respect for [one's] private communications". Well, "respect" is a vague notion. This does not clearly imply that the government is not allowed to read your communications, or otherwise spy on you, if it believes it has good reason. It will do so "respectfully", or supposedly minimize the intrusion etc.
As for article 8: Here it is "protection of personal data" and "fair processing". It does not say "protection from government access"; and "processing" is when the government or some other party already has your data. In fact, as others point out, even this wording has an explicit legitimization of violation of privacy and 'protection' whenever there is a law which defines something as "legitimate basis" for invading your privacy.
You would have liked to see wording like:
* "Privacy in one's home, personal life, communications and digital interactions is a fundamental right."
* "The EU, its members, its bodies, its officers and whoever acts on its behalf shall not invade individuals' privacy."
and probably something about a non-absolute right to anonymity. Codified exceptions should be limited and not open-ended.
Which is... okay? Government gonna government, that's what we pay it to do.
