The US has remarkably weak privacy laws, does it not? As in there aren't really any laws on data retention, pseudonymization etc. let me know if I've got the wrong impression.