The point is though that a EU citizen has zero privacy rights when data is transferred to the US. Zero. Not US level protection, not EU level protection - just fair game.

For that simple reason the EU has to step in. There is no other way.