Sounds like a feature, not a bug.

The US "Safe Harbor" was always a joke. It was a work-around because the US refuses to enact data protection laws that give Internet users strong rights against businesses.

Read the EU Data Protection Directive.[1] EU citizens have have the right to demand some things of the "data controller" who collected data about you. They can demand a copy of the data. They can demand corrections. They can demand to know of any other parties possessing copies of the data. They can demand to know what other parties are doing with it. These rights cannot be waived. "Data controllers" have to register with their country's data protection authority, and list what data they are keeping about individuals. Individuals can complain to the data protection authority if there are violations; they don't have to sue.

Consent must be explicit. An EULA is not enough. "Every consent must be given in an unambiguous way. This means that there should be no reasonable doubt that the data subject wanted to communicate his or her agreement to allow processing of his or her data. Deducing consent from mere inactivity is not capable of delivering unambiguous consent, for example. Where data to be processed are sensitive, explicit consent is mandatory and must be unambiguous."

An individual's consent to share personal data can be withdrawn at any time. "Example: A customer agrees to receive promotional mail to an address he or she provides to a data controller. Should the customer withdraw consent, the controller must immediately stop sending promotional mail. No punitive consequences such as fees should be imposed. If the customer was receiving a 5% reduction on the cost of a hotel room in return for agreeing to the use of his or her data for promotional mail, the withdrawal of consent to receiving promotional mail at a later stage should not result in having to pay back those reductions."[2]

Incidentally, this applies only to "natural persons", not corporations or businesses. Businesses come under the European Directive on Electronic Commerce, which requires disclosure, not privacy.

Since the entire EU has been under these rules for over twenty years now, this is not impossible. But it's something US companies now have to get used to.

It's not a problem for companies which collect customer data for internal use only. It's a big problem for companies which sell that data. That data isn't theirs to sell under EU law. The individual has ownership of their own data.

[1] http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:319... [2] http://fra.europa.eu/sites/default/files/fra-2014-handbook-d...