Is that enough? If a company uses google services , they are liable if google decides to take a bite at this data (because e.g. NSA asked them to). And it's not

Is that enough? If a company uses google services , they are liable if google decides to take a bite at this data (because e.g. NSA asked them to). And it's not enough if google makes a contract that promises not to do so. the company is essentially liable for the NSA - Ironically, if Google does create an EU spinoff just to run analytics as a free service, it will kill the local competitors - The NSA is not "exempt": https://www.eff.org/deeplinks/2020/07/eu-court-again-rules-nsa-spying-makes-us-companies-inadequate-privacy https://www.eff.org/deeplinks/2020/07/eu-court-again-rules-n...