Points 28, 38, 39 may apply here. I haven't studied this directive but its spanish implementation(IANAL, but if you work with personal data you need to know how to comply), and under that law, users should be asked for explicit permission unless Facebook had stated to them beforehand that they could transfer their data to a third party for a particular purpose at the time of the collection of the data. In that case, there should be a signed contract between both parties (Facebook and you), which states the purpose and duration of the treatment of the data. After that treatment, the third party should destroy that since it's not authorized to use it anymore.

Anyway, as everyone here knows, its pretty hard to enforce this kind of law.