As far as im aware, its not in breach of the data protection act. People seem to be throwing that bit of legal stuff arround far to much these days. The data protection act is about how information about a living person is stored. The best way i can think of for ISPs to see what website the users are visiting, is by the DNS servers, so that when someone trys to connect to a website, the DNS servers provided by the ISP resolve the domain to the ip of the website, all they have to do now, is log that request for the direct ad program.
If they did it like this, i cant see how it will be in breach of the data protection act, as they are NOT giving out personal information. As for the european legislation, please find me specificaly what makes it illegal, because so far it seems compleatly legal.
If this is the case by the way, a simple change of DNS servers to ones that dont send the data to direct ad companys will solve the problem. I daubt the ISPs will do anything more complex to get this data for the direct ad company, because they cant spy on a users activitys without a court order, and ISPs wouldnt risk loosing hundreds/thousands of customers because of a scandal like that.