Do that law prevent surveliance initiated by the state, and does it put liability at those who use the services rather than putting liability at those who offers the service?
Ie, can someone use that law to sue a doctor who happens to use gmail/microsoft/icloud for communicate with his patients?
http://export.gov/safeharbor/eu/eg_main_018365.asp
US companies that want to hold EU data in the US have to guarantee the same level of protection the EU provides.