There’s a topic about this on Feverbee.
Rather than trying to parse the text of the EU directive itself, I suggest you follow the directions and suggestions of your relevant national data protection authority (DPA).
Your DPA is the relevant compliance authority, so their position is what you should care about.
There is a list of DPAs here. For example, the UK’s DPA is the “Information Commissioner’s Office”; they have an interactive toolkit to help you out.