If the US had serious privacy protection rules there would be no data to sell to russian companies. Obviously that also means there would be no data to pass to 3 letter agencies, so probably we won't see them any time soon.