I think it's a fair criticism to fear that the data may end up in the hands of well intentioned but poorly secured applications that cause larger leaks, but we've seen huge leaks in the US even from companies that exist solely due to the value of their data (i.e. Equifax).
To me it seems like the smaller and more local your infrastructure becomes the worse the privacy story gets. Worst of all would be a completely bespoke infrastructure self-hosted by local authorities, where a handful of petty IT guys have complete access to everyone's data. Sure, it's against the law for them to access it, but they will do it anyway, because there are no internal controls nor effective audits.
Way on the other end of the risk scale is the idea that an American court will order Google to turn over the files of a Danish schoolchild to intelligence agencies. That's just a complete non-risk compared to the insider risks in the other scenario.
There is no winning scenario by continuing to use foreign products that are subjugated by foreign laws, so might as well try to get something done on the inside. That or declare privacy dead already and move to the next thing to lose control over.
The thing that set it off was "a 2013 drug trafficking investigation, during which the FBI issued an [Stored Communications Act] warrant for emails that a U.S. citizen had stored on one of Microsoft's remote servers in Ireland, which Microsoft refused to provide." The US promptly changed the law to require US companies comply with search warrants, regardless of where the data is located. European Data Regulators have a big problem with this.
https://www.imy.se/en/organisations/data-protection/this-app...
I think the problem is the complexity of running an international software business is getting harder and more complex and that is actually reducing security.
I would encourage anyone who has ever tried the "but China" defense for Big Tech to go back to the drawing board, and come up with something that isn't out of the Trumpist playbook.
Second: Europe has access to a robust collection of open source solutions that are also used by many of those same companies. You can absolutely create a managed experience working around the already tried-and-true Linux platform, and Windows is, of course, still perfectly serviceable if appropriately neutered by policy and a quality enterprise-class firewall.
Europe should absolutely be applauded for keeping their citizen's data increasingly in-house, particularly because we in the US have repeatedly failed to put Sundar Pichai and Mark Zuckerberg in the prison cells they so desperately belong in.
The risk model where American intelligence courts are the top line item is stupid.