Those of us outside the USA, and not subject to its Law, may find the following of interest.
It concerns the idea of Safe Harbour [somewhere to keep data].
By my understanding, SH was largely about stuff like "if a company collects data about you, what can they do with it and who can they pass it to?" and allowing European companies to pass data to US companies, but the European court ruled that SH wasn't giving adequate privacy protection.