The prime directive in the EU is known as the "Data Protection Directive". Member states implement their own laws that are expected to be consistent with the directive. It is similar to the PCI standard in that it is vague and verbose. However, there are seven general principles that are mostly common sense. The one that may be of interest to you is #4:
Security—collected data should be kept secure from any potential abuses;
And Article 17:
Article 17 - Security of processing
- "Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
"Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected." ... (remainder elided).
EU site: (good luck navigating this)
I don't think the practice of storing passwords in clear text would be acceptable in the EU, because: implementing a password hash is trivial and does not increase costs; this is contrary to generally-accepted security best practices; and it would almost certainly fail an external audit, as there is the potential for abuse if the passwords were disclosed, and you have no way of validating the person using the password is who they claim to be (i.e., you only use passwords for authentication and no second factor).
To facilitate commerce, the US and the EU have a "safe harbor" agreement, that allows US companies to collect data from EU citizens, as long as they "self-certify" with the US Department of Commerce that it complies with seven principles.
The EU-US Safe Harbor Does Not Protect US Companies with Unsafe Privacy Practices: