Foreign companies shouldn't have the same protections.
And in many countries, locally-operating subsidiaries are required to have majority ownership by citizens, partly to prevent foreign influence.
I would characterise our lack of rights as complete. Some years ago Americans began torturing people who had been handed over to them on the promise that they would not be tortured already at Bromma airport, so here in Sweden, and this was presumably legal. I assume that if it had been done to me, it would have been legal as well.
Data rights are not embedded in the constitution and so the US is currently in the process of creating a patchwork of (mostly state driven) legislation to define how user data can be treated. Hopefully, the Federal government will step in at some point and create some consistency and clarity with rules that are both practical and efficacious.
[1] Source: 8th Amendment
There is an inferred right to privacy though, and that is for this same reason not something applicable in cases of non-Americans and non-US residents when outside of the US.
There are already rules, there's the EU–US Data Privacy Framework, but it's implemented by an executive order, so there's nothing preventing there existing some other executive order secretly negating it.