Not that much.
The is a single EU privacy directive, (95/46/EC), and an extension to provide better privacy for online data (2002/58/EC). All the member state have implemented the same directive. What changes among states are just implementation details (as a programmer would say).
The thing to note here is that the EU directive provides a blanket exception for almost all governmental organizations and for all the police branches. This means that something like PRISM, if architectured in a proper way, would be completely legal.
Truth be told, in EU most telcos and ISP are forced by the law to keep track of all the communications and forward them to the relevant authorities either in batch or on demand.
The state of the political part of the EU is not the mess many politicians say.
However, my main point is that in EU a program like PRISM would be totally legal under current laws. And it is probably already in place if you think about the SIREN program and you make it access the wealth of data harvested through the data retention directives.
I'm not saying that they can't do that. I'm saying that they are thinking twice about it.
This is a fallacy that gets repeated a lot.
First of all, the EU is not a single entity, but rather a hydra with many heads. The competency and resources of "intelligence agencies" varies a lot by country, the privacy laws and the wire-taping/surveillance culture too.
If you are speaking about the UK, sure, but try doing this in Germany. Also, in my country (Romania) the government wouldn't have the resources for it and they are too incompetent to cooperate with other agencies without people finding out about it. I also cannot see France doing this, since the French get pretty violent when they get upset. So what EU are you talking about exactly?
Second, even if snooping of online activity does happen in an EU country, at least it's an EU intelligence agency you're talking about. This is relevant for US companies, because I don't know how much EU's governments care about our privacy, but I can assure you that they care about leaks to the US or China or other non-EU countries. Which means US companies will suffer for it.
The USA was and is still seen as the benevolent dictator of the Internet. That's why we've been accepting your governance of TLDs, or your online services. That's why we've been blaming China for their tight control of online access. But if the US government keeps jerking around much, things will change.