PRISM can exist, AND they cannot have direct access to Google data. Both can be true.

There is another vector of privacy leakage here - there are also the ISPs, who I am pretty sure work alongside the government in a majorly secretive way.