[josefx]

> It doesn't matter if there are safeguards, technical, or institutional preventions in place.

Except the American company made it clear that no such safeguards will be in place and that it will transfer the data out of its EU servers if legally complied to do so. This can be found in the German text at https://rewis.io/urteile/urteil/ocw-13-07-2022-1-vk-2322/ .

> Regions. Customer can specify the location(s) where Customer Data will be processed within the X. Network (each a "Region'), including Regions in the EEX. Once Customer has made its choice, X. will not transfer Customer Data from Customer's selected Region(s) except as necessary to provide the Services initiated by Customer, or as necessary to comply with the law or binding order of a governmental body.

Any governmental body can request access to EU users data and the data will be moved out of the EU region. At best it provides that it will challenge any inappropriate or overly broad request, but there is no legal framework for what qualifies as such between the EU and US and the US is unlikely to care about challenges that have no legal basis.

[viro]

> that it will transfer the data out of its EU servers if legally complied to do so.

They have a legal search warrant, This is a EU country they likely have Law enforcement and judicial cooperation treaty with the US.

[josefx]

There was a treaty how to deal with data protection between the EU and US, it was killed by a court decision best known as "Schrems II". Trying to get the EU data protection laws and the US governments need to collect all the data to play nicely is a non trivial and maybe even outright impossible undertaking, so no replacement currently exists.