> EU law has supremacy over national laws
This only applies where countries ceded sovereignty to the EU.
Technically in Germany non of the sovereignty was ceded but transferred based on two different articles in the German Constitution. But that transfer is neither absolute, nor automatic. Practically it means that in most situations it is "as if" it was cede, but just in most situations.
This leads to a situation where if the supreme court rules that some EU regulations or similar are against the German constitution you have a conflict between the constitutional articles which transfer authority and the ones the court ruled to have been infringed one.
But in the German constitution not all articles are equally, the first few have special protections and extra hurdles to amend. And the article which transfers powers to the EU _is not one of them_. This means that for any of the more protected clauses Germany has not at all ceded the authority of their supreme court to do a final judgement on.
In such cases if the German supreme court says no, it's means no for any application of law in German no matter what the EU courts say. And there are only 3 ways to fix that, 1. the EU amends their regulation, 2. Germany amends their constitution (practically impossible in such cases), 3. the rule informally applies to everyone but Germany, 4. Germany leaves the EU which would likely mean it's end.
So while everyone pretends there is no issue (3rd option) can in some situations be viable and given that 2 is non-viable it pretty much always ends with a compromise of amending things just far enough to not longer cause an issue with the German constitution.
Systematic breaches of privacy through mass surveillance fall under that especially protected articles in the German constitution. And option 3 doesn't really work here. So it's one of the rare cases where German Supreme court actually matters on EU level.
Through practically it hardly ever matters outside of very very few cases:
- because of Article 1 (the most protected one you could say), the ECHR has more or less implicitly the same amount of power as the supreme court, only if the ECHR does rulings in conflict with human rights would that not be the case (so in practice never)
- as one of the core founding members and the country with the largest population (and seats in the EU parliament are distributed based on population) Germany can normally make sure such a situation doesn't arise
- and the breach must really be of a constitutional article standing above the one which transfers power to the EU (which most are not)
- you have to propagate things up to the supreme court, while all other courts will rule based on EU law/ECJ decisions
but it doesn't mean that it never happened,
e.g. there had been one case where the German supreme court ruled that a) something is against the constitution and b) that the EU organ which caused this acted unreasonable in a way which isn't covered by the transfer of authority. That case go resolved with compromises, but was neither the first nor will it be the last where "in practice" the German Supreme court overruled EU decisions, even if it on paper doesn't (because it only overrules what happens with law in Germany and overruling an EU decision would affect other countries, too).