Points 28, 38, 39 may apply here. I haven't studied this directive but its spanish implementation(IANAL, but if you work with personal data you need to know how to comply), and under that law, users should be asked for explicit permission unless Facebook had stated to them beforehand that they could transfer their data to a third party for a particular purpose at the time of the collection of the data. In that case, there should be a signed contract between both parties (Facebook and you), which states the purpose and duration of the treatment of the data. After that treatment, the third party should destroy that since it's not authorized to use it anymore.
Anyway, as everyone here knows, its pretty hard to enforce this kind of law.
Well there is really nothing to enforce when you agree to Facebooks TOS and Privacy Policy upon signing up. Facebook has never forced you to sign up.
Excerpt from privacy policy:
Certain categories of information such as your name, profile photo, list of friends and pages you are a fan of, gender, geographic region, and networks you belong to are considered publicly available, and therefore do not have privacy settings. You can limit the ability of others to find this information on third party search engines through your search privacy settings.
Anyway, as everyone here knows, its pretty hard to enforce this kind of law.