They actually have to pass a new law before 2018. There's a EU directive, and the way these work is that they require the member states to pass laws implementing them, while leaving a bit of wiggle room allowing the national parliaments to fill in the details.

This specifically is still far from being a done deal. Note that it's only the secretary of the interior proposing it. That position is traditionally filled with a hard-line law-and-order politician (and even if it's a tree-hugging hippie, he somehow turns into such). There are plenty of people even on the cabinet level with different views – usually the justice minister pushes back from a civil-liberties focused position, and the social democrats whose votes are needed in parliament may also consider this one of the rare opportunities to publicly oppose Merkel's party.

After that there's the constitutional court, and then the European Union institutions also get to have their say again, and they also tend to favor civil liberties.

I'd also caution to not take the headline at face value – the public hasn't seen this draft and only gets the version filtered through interest groups. One example: dropping the right to be informed about collected data is limited to cases where this would "seriously endanger a company's business purposes". That seems to me as if it's meant to apply to specific, known situations – who knows, maybe someone asked Amazon for a printout of their data to get around the Glacier Storage retrieval fees. These exceptions would probably be nailed down to apply to the few situations where it may be sensible.