The US could be very well in on it. What if US companies could use the NSA data for business benefits? And that happened. The EU needs to stop seeing the US as its ally, and protect itself adequately. GDPR is one step in the right direction.