EU directives are in general just guidelines. The EU is a culturally and politically diverse part of the world and there are differences between countries like night and day.
The EU directives are legally binding acts that force every member state to implement them in 2 years and in the proper way. Big fines have have been levied in the past against member states that tried shortcuts. The EU directives are also more powerful than local laws: if a state law conflicts with a directive, the directive takes precedence.
The state of the political part of the EU is not the mess many politicians say.
However, my main point is that in EU a program like PRISM would be totally legal under current laws. And it is probably already in place if you think about the SIREN program and you make it access the wealth of data harvested through the data retention directives.
