1. If it's encrypted, it doesn't matter where it's stored.
2. If it's not encrypted, it can be easily stored in country X, processed in country X, but routed via SnoopHub in country Y. Country Y loves surveilling and is very happy about this state of affairs.
>I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things.
A very common attitude, usually held by people who "geographize" that which is not geographic in nature - the Internet.
There's no reason to believe that Visa/MC would simply use 'America' as a based to host dumb, encrypted data which enters and leaves the the US fully opaque. That would be pointless. Visa/MS are using services hosted in the US which will process customer data.
2) Statement #2 is also false. There is no arbitrary way for the US to snoop on data that doesn't flow through the US. For a whole variety of reasons - legal, operational, technical, political, cost etc.. Surely it can be done in a limited way, but at a level nowhere near the domestic capability.
3) Finally, you're statement on "geographizing" is also false.
Data, encrypted or not - falls under legal jurisdiction of the 'nation / geography' it's in, and this has many significant consequences. It makes a corporation subject to local laws, regulations, liabilities etc..
The internet is very geographic in nature.
Jurisdiction is huge thing, not a side show.
Data that sits overseas is subject to entirely different sets of laws which can conflict with local laws.
Those laws also relate to espionage, and even outside the framework of legality ... it matters as well.
It's a lot easier for the NSA to collect data on individuals if it's hosted in the US.
I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things.