While the event took place with a Spanish company, are European-wide regulators not more stringent?
There’s a big difference between American Federal law where the Feds are in charge of enforcing Federal law and the States are in charge of enforcing their own laws; and Pan-EU laws where a law is really an agreement to pass a bunch of laws by the member nations who then enforce them using whatever enforcement mechanisms they have. By passing the agreement as laws through their own legislatures, they in effect become a part of each member nation’s national laws. As far as I know there’s no EU FBI/DEA and the closest agency to it is more like Interpol.
See also the kerfuffle between Apple, Ireland and the EU where the EU went after both Apple and Ireland to get the Irish to enforce some European agreement that may or may not have prohibited whatever Irish tax regime was (is?) in place.
These types of EU laws are called EU directives, which as you described first need to be "transcribed" into national law by the respective parliaments. As a result they don't go into into force in all member states at the same time, and there is some more leeway concerning their implementation.
However, there are also EU regulations, which are immediately binding in all member states in their original form as soon as they are passed by the EU, much like US federal laws.
It is true though that even for EU regulations, the EU generally does not have their own enforcement capability and so there can still be differences from state to state on how strictly regulations are interpreted.
The GDPR (General Data Protection Regulation) is an example of the latter kind of law, btw.