Just need to pass it once, unfortunately. And despite all the talk against it, they get a partial fresh start to the general public every time one of these is proposed.
Honestly, I fully expect that the scanning method is already implemented and used. The US has intervened with some pretty deep surveillance in the past (ie. Canada Sihk killing) and doesn't seem to need permission to get it.
Sounds to me like the EU is looking to get a more formal approval to act on data they already have.