It's actually USA law that is the problem here. Specifically, the fact that USA agencies can do whatever they want whenever they want with EU citizens data and

It's actually USA law that is the problem here. Specifically, the fact that USA agencies can do whatever they want whenever they want with EU citizens data and have 0 accountability to EU citizens. Basically, we have as much rights as USA intended for terrorists. We had "Privacy Shield" framework that was allowing to transfer data to USA, but the framework (and the one before that) was invalidated by the European Court of Justice in Schrems II ruling due to lack of protections for EU citizens in USA law.