If I have to provide my date of birth (or other personal info) to a web site then I expect them to keep that personal data confidential. If I then use their service to advertise to the whole world 'Hey, I was born on...' then that is MY responsibility, not theirs.

Do Facebook and MySpace have enough of a physical presence in Europe for the EU to make this stick. It is one thing to declare that: "...social networking companies count as data controllers under EU law 'even when their headquarters are outside of the [European Economic Area]'", but if there isn't a (non-headquarters) physical operation within the EU, I am not sure whether there is any reason for Facebook and MySpace to pay attention to what the Article 29 Working Party says. There are some on this site who are quick to admonish Americans that US law is sovereign only within the United States. This is an opportunity for me to point out that this particular street runs 2 ways, with EU mandates only being enforceable within the EU.

I think you are missing my point, if Facebook and MySpace have all of their servers and offices outside the EU, they can tell the Article 29 Working Party "ODFO" and the EU can do ... What?... about it. It is not illegal in the US, so far as I know (IANAL), to store customer details on a server here regardless of where the customers come from- no permission needed, so if all the offices and servers are in the US that is all that matters. That is the two way street I was talking about, if it is unreasonable for Americans to expect, say, 1st Amendment rights to speech to apply outside the US, it is similarly naive for Europeans to expect EU data laws to apply extraterritorially.