It is a concern either way. His point seemed to be that if it were hosted by an EU entity, then at least it would be bound by EU data privacy laws. I'm not super familiar, but I think those are more strict than US privacy laws, for whatever that's worth.

The governments will be spying either way though, so I personally don't think it's much of a difference.