Because US companies are hamstrung by US laws that prevent them from complying with EU law (i.e. US govt says you must give private data to us and EU says you can't give private data to non EU govt). Other companies not based out of the US can guarantee privacy that meets EU spec if they don't have local laws compelling data access. So it might not be EU companies that capatilize on it but there can be a market opportunity that US companies can't fill.