Viviane Reding wrote that she was concerned America's efforts "could have grave adverse consequences for the fundamental rights of EU citizens".
A series of leaks suggest major tech firms have passed information to the National Security Agency, the US government's snooping organisation.
Experts say they could now be sued.
"European data protection laws put restrictions on how data gathered about people, including social networking data, can be used," said Dr Ian Brown, associate director of Oxford University's Cyber Security Centre.
"The firms will now face serious questions from national data commissioners and even potentially from individual users in Europe over whether they followed all the European data protection laws that are supposed to stop things like this happening."
According to leaked documents published by the Guardian and Washington Post newspapers, the NSA can order internet firms to give it access to private emails, online chats, pictures, files, videos and other data uploaded by foreign users.
Google has said that its compliance with the requests did not give the US government "unfettered access to our users' data", but notes that nondisclosure obligations prevented it providing detailed information to the public.
Along with Facebook, Microsoft and Twitter, it has asked to be able to be allowed to publish information about the number and scope of the requests received.
Media reports suggested Yahoo, PalTalk, AOL and Apple have also been involved in Prism.
US intelligence chiefs have said that the data-sweeps save lives by helping thwart terror plots.
In her letter to Eric Holder, Ms Reding asks questions on seven areas of concern about Prism and other US data surveillance programmes:
Ms Reding added that American law enforcers should only be given access to EU citizens' data being held on US companies' servers in "clearly defined, exceptional and judicially reviewable situations".
A spokeswoman for the commissioner confirmed the letter had been sent on Monday evening, and that Ms Reding expected detailed replies to her questions when she meets Mr Holder at a previously scheduled event in Dublin on Friday.
The EU's Justice Commissioner has written to the US attorney general, questioning him about America's data surveillance programme, Prism.