The US companies can be forced by the US government to be kept quiet about the data they revealed. However, their subsidiaries are European companies, and therefore must comply to EU law, therefore they shouldn't share the data, and if they do, that's a crime, and if they furthermore keep quiet about it, it's an even bigger crime.

I think they should be punished by law to the fullest extent available. Along with everybody that was responsible and is within the reach of EU law.

Actually, the EU should request extradition of those responsible that reside in the US, even if they didn't break the US law. Fair, isn't it?