Yes this type of data is in the EU area considered as belonging to the customer not to business. The US and the various European countries have totally incompatible legal views on data protection so it should hardly be a surprise that eventually the EU is going to say that US companies have to follow the local laws.