[petre]

The GDPR was passed by the European Comission, not the EP. Members of the EC are appointed, just like ministers in governments. But governments can only pass time limited decrees which then have to be signed into laws and voted for in Parliament. The EC which can pass binding regulations that apply indefinitely.

[synotna]

I think you mean "proposed" instead of "passed" - "passed" is usually used to mean "passed a law"

The commission proposes legislation, the council & parliament pass it

[M2Ys4U]

You are wrong.

The GDPR was formally proposed by the European Commission, but it then went to the European Parliament (where it was amended). If the European Parliament had voted against it then it would have never become law.