There is one key issue that is routinely ignored. The US and other countries have two sets of data protection rules that govern police and security services. One set of rules for residents of that country (e.g. US persons) or domestic data and another much less stringent set or rules for everyone else.

So even if data protection rules were perfectly adequate in every single country on this planet, there would still be justified concern about transferring data across borders.

That's a situation that must change, and it can change without taking away the bowl of sweets from security agencies altogether (which will never happen).