A tough new EU cyber law is off to a messy start, with many countries failing to adopt the rules