>They actually have to pass a new law before 2018. There's a EU directive, and the way these work is that they require the member states to pass laws implementing them ...
Assuming you're referring to the GDPR (General Data Protection Regulation), it is in fact a regulation as opposed to a directive. The difference being that directives have to be implemented at the member state level, but regulations do not. Regulations are effective union-wide once they come into force.
I thought it was something lost in translation, or just a mistake. But it turns out there actually is an accompanying directive "for the police and criminal justice sector" (Directive (EU) 2016/680).
Assuming you're referring to the GDPR (General Data Protection Regulation), it is in fact a regulation as opposed to a directive. The difference being that directives have to be implemented at the member state level, but regulations do not. Regulations are effective union-wide once they come into force.