As others have mentioned:
1. this wasn't fast, it took ~5 years and most (but not all) of the problematic parts have been removed
2. It also wasn't "fully rejected" or anything in the decision which gained some awareness of hacker news, just one specific draft was rejected, not the proposal as a whole (but IMHO it should have been).
3. it's not passed just approved by the council, which consists of the various head of states elected in their respective countries (i.e. is the easiest part to pass something controversial), but still needs to pass the European parliament (elected through the EU elections)
4. and then it must not be shot down by the ECJ or ECHR, both might shot it down, the ECJ for it being excessive/disproportional, and the ECHR because privacy is accepted as a human right by it (in general, there are exceptions so not 100% guaranteed). Or shut down by the German supreme court (same reason as ECJ and ECHR) which has somewhat of a veto right (or else Germany wouldn't have been able to legally join the EU), idk. if any other countries supreme courts have similar veto rights, but idk. why they shouldn't have)