How does the constitution protect the rights of citizens?

Acts of Parliament protect rights.
The Human Rights Act 1998 incorporated ECHR articles into UK law, such as Article 10 (freedom of expression).
The Freedom of Information Act 2000 allowed the public to access information held by public authorities, such as references written by teachers.
The Data Protection Act 1998 placed restrictions on the storage of data, gave individuals the right to see any data about them and have factual inaccuracies corrected.

If UK citizens feel that their rights have not been protected in UK courts, they can take their case to the European Court of Human Rights, which was established in 1959 to help uphold the rights listed in the European Convention on Human Rights.
After the Court of Appeal did not award a British Airways employee any damages in Eweida v British Airways (2010), she appealed to the ECtHR. Eweida had been sent home on unpaid leave for refusing to cover up her necklace of the Christian cross, which the ECtHR ruled in 2013 violated her Article 9 right to observe a religion.
215 of the 390 cases admitted from 1999 and 2010 resulted in a judgement that the UK had violated the ECHR.
Compared to other nations under the jurisdiction of the ECtHR, the UK has amongst the lowest number of cases brought against it and loses far fewer than many other countries, suggesting that the UK is already successfully upholding rights and civil liberties.

In 1974, there were just 160 applications for judicial review in England and Wales. This had risen to 4,539 applications by 1998, and then over 11,000 by 2012.
In the case R (Evans) v Attorney General (2015), the Supreme Court ordered the release of letters written by Prince Charles to government departments, after the Attorney General tried to veto their release and overturn the decision of an Upper Tribunal headed by a High Court judge.