The problem with the USA isn't actually the lack of data protection itself, that can be handled through contract law. The problem is the lack of protection from the US government through the PATRIOT ACT and its successors.

The laws themselves exist to a certain extent, but the government places itself above the law in ways that aren't acceptable inside the EU and the other states who implemented the GDPR.

This is because Europe is not part of the USA, which means the protections against tyrannical government interference don't apply; those protections only apply to Americans.