The GDPR was formally proposed by the European Commission, but it then went to the European Parliament (where it was amended). If the European Parliament had voted against it then it would have never become law.