It's written as if dubious access to data by US (and other; see ECHELON) security services is a startling new revelation, whereas in fact it has been a known risk for a couple of decades, and certainly a consideration when using hosted services. Here is a European commissioner raising it as a concern with respect to the Data Protection Directive, over a decade ago, for instance:
http://europa.eu/rapid/press-release_SPEECH-01-368_en.pdf