I often come back to privacy education. I'd even go so far as to say that the public isn't necessarily very literate when it comes to privacy, and that there's still an educational mission to be fulfilled here.
It seems to me that we might prefer to have a law rather than a directive, but the fact remains that it would be a measure used to right wrongs rather than to prevent breaches in terms of culture. I often put the same question to the Information Commissioner: does the government have a culture of opacity or transparency? She answers that it has a culture of opacity.
In this case, transparency wasn't there either, and I find that worrying, because it prevents us from having a culture of accountability.