It is US company. It does not matter where the servers are physically located.
I genuinely don't know how they would proceed, but it'd be interesting to watch.
They can physically tap global internet cable just because they can
Agreed, the union doesn't have any enforcement mechanism I'm aware of that would fit, but any country in Europe could do a similar thing to companies based in their borders.
Member states have spy agencies, but they also signed treaties to join the EU. Having your spy agency violate international treaties isn’t something most governments allow.
If the information is stored in a country, expect that the owner of the information can be compelled to hand it over by a court order (or it can be seized).