My point is that the number of countries with the capacity/capability to provide the level of service that the US provides is quite small. Of those, I imagine most if not all of them have similar data gathering practices that extends to their own citizenry, so non-citizens are not even an issue.

Let's look at the list of countries (order is random):

1. EU (probably only France, UK, Germany, possibly the Netherlands) 2. Israel 3. Canada, solely by proximity to the US 4. Japan 5. China 6. Brazil 7. Russia 8. Australia, that's a big maybe though 9. India 10. Iran 11. South Korea 12. Singapore 13. South Africa 14. Scandinavia (Finland, Denmark, Sweden)

These are the countries that likely have the technological advancement required to even offer cloud-based services of the scale and capability offered by US based organizations.

This is also assuming that significant parts of their overall connectivity does not route through US controlled territories or demarcation (which likely rules out any south-east asian country like South Korea, Singapore, also Canada and Australia).

Of those remaining on the list, very few of them have even have civil liberties legislation codified. A rough guess might be:

1. EU 2. Israel 3. Japan 4. Brazil 5. Scandinavia 6. South Africa?

Israel we could likely rule-out. Not exactly the most trustworthy government, and the close ties with the US likely means that they either participate in or benefit directly from PRISM.

As a collective whole, the scandinavian countries likely could offer the level of cloud-based services provided but not individually.

So, in no particular order:

1. France 2. UK 3. Germany 4. Japan 5. Brazil