NOTE: I AM NOT A LAWYER, JUST AN INTERESTED BY-STANDER. In no way should the following be construed as more than just a noting of facts, and if there is an error, please point it out for correction. Thank you in advance.

According to the EUR-Lex website, Directive 95/46/EC was repealed/superseded by 32016R679 (also known as the EU General Data Protection Regulation (GDPR)), and is no longer valid after 2018-05-24.

As noted by the OP at the time of this writing, the "problem [is] undergoing mediation".

(As I was composing this, I saw LanX's post, which stated what I was thinking (but in a clearer form).)