Also in the EU, security agencies and the police can have access to individual accounts, but only in the case of an criminal investigation and only with an court order. Even very privacy oriented services and apps have to give access to the data they have, in this case. But this, if these data are encrypted, there is few what the authorities can do, then they have to contact the user directly to obtain the encryption key, or trying through weeks to crack it. But all this has nothing to do with privacy, it’s not the same as sharing freely user datas to third party advertising companies, like it is possible in the US, in the EU it’s only alowed in a very limited way to share statistical, anonymised and tech data.