Don't forget about the CLOUD act that was snuck in. Just a little excerpt on what it does.

The CLOUD Act will allow foreign law enforcement to request data from American companies, even if the data is hosted on U.S. soil, without obtaining any judicial approval or warrant from a U.S. judge. It will also work in reverse, and it will essentially undo an Appeals Court's ruling in the U.S. that said that law enforcement can't get an American's data if it was stored on servers abroad.

http://www.tomshardware.com/news/big-tech-cloud-act-surveillance,36730.html