However EU nationals have rights under EU law, and data protection "safe harbour" rules require that information of EU nationals that's exported from the EU should be protected.

I believe the Microsoft case in Ireland is about this question.

Edit: see also curia.europa.eu/jcms/upload/docs/application/pdf/2015-09/cp150106en.pdf

"The Advocate General considers furthermore that the access enjoyed by the United States intelligence services to the transferred data constitutes an interference with the right to respect for private life and the right to protection of personal data, which are guaranteed by the Charter. Likewise, the inability of citizens of the EU to be heard on the question of the surveillance and interception of their data in the United States amounts, in the Advocate General’s view, to an interference with the right of EU citizens of the to an effective remedy, protected by the Charter."

=> therefore the "safe harbour" allowing the export of private data from the EU to US servers can and should be suspended.