Because it is an EU-DIRECTIVE.
Directives are not the same as regulations .
Directives are goals that must be achieved by adapting existing national laws or introducing new ones, and that takes time.
Sadly, the EU is also lax when it comes to enforcing regulations. See GDPR.
Sadly, the EU is also lax when it comes to enforcing regulations. See GDPR.