Under the European law, companies have an obligation to protect personal data.
Do US companies have the same obligations?
US privacy laws, except with respect to medical information, are not regulated by statute, however, US companies can be sued for the tort of breach of confidence and, where a contract deals with the matter, breach of contract. That is, it is considered to be a private wrong, not a matter of public policy.
However, US companies/businesses that operate in other jurisdictions (e.g. by selling their products over the internet) are subject to the laws of those jurisdictions and could be prosecuted by the state in say a UK or French court if they don't.
I am unaware of any cases relating to privacy, however, to illustrate that foreign (US) corporations are subject to domestic (Australia) law see https://www.accc.gov.au/media-release/full-steam-ahead-accc-institutes-proceedings-against-valve-for-making-alleged-misleading-consumer-guarantee-representations
“The Australian Consumer Law applies to any business providing goods or services within Australia. Valve may be an American based company with no physical presence in Australia, but it is carrying on business in Australia by selling to Australian consumers, who are protected by the Australian Consumer Law,” ACCC Chairman Rod Sims said.
For completeness, Valve's defence argues that the applicable law is Washington, USA, not Australia and that, in any event, they are selling a service not a product (which goes to the particular breach alleged) - this is scheduled for mediation on 1 April 2016 and, if necessary, court in July.
European privacy law is substantive, meaning there are things you can and can't do with personal information.
US privacy law is very different. Instead of substantively regulating what you can and can't do, it focuses instead on disclosure: it says you must disclose what you do with personal information, and your disclosures must be accurate.
To oversimplify a bit, if you are a US company doing business in Europe, you're going to be subject to both sets of law.
Things get even more complicated if you are transferring EU citizens' personal data out of Europe. Until recently, the US and EU had a deal called the "Safe Harbor" framework. That was chucked out last year, and now there's a new deal called "Privacy Shield". Under Privacy Shield, US companies can take on many of the substantive requirements of EU privacy law. This is a very tricky area, and even those of us who work in the field are still figuring it out.
US companies don't face the kind of governmental, "criminal" exposure that EU companies face. Often though, companies that deal with personal identifiable info do, however, have to answer to certification organizations.
Also, if it's anything medical, they DO have to answer for it.
Other than that though...it's the "wild west."
According to the new "Privacy shield" legislation that US companies must follow when handling personal data if EU citizens:
Annex 2, page 6, point II.4.a:
Organizations creating, maintaining, using or disseminating personal information must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.