The problem isn't just the servers being in the US, the bigger problem is that the USA's CLOUD Act allows them to get any data from any server, anywhere, provided that it is owned by an American company. This article from the Dutch National Cyber Security Center explains it a bit more.