You work for a multi-national IoT device vendor. Your European customers are complaining about their inability to access the personal information about them that you have collected. Which of the following regulations is your organization at risk of violating?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU). A core tenet of GDPR is granting individuals, referred to as data subjects, specific rights over their personal data. The scenario describes European customers being unable to access their personal information, which directly relates to the "right of access by the data subject" enshrined in Article 15 of the GDPR. This right mandates that organizations must provide individuals with a copy of their personal data upon request. As the company is a multi-national vendor with European customers, it is subject to GDPR and is at risk of violating this fundamental right.

A. Sarbanes-Oxley (SOX): This is a United States federal law focused on corporate governance and financial reporting to protect investors, not a regulation concerning consumer data privacy rights.
C. Electronic Identification Authentication and Trust Services (eIDAS): This EU regulation standardizes electronic identification and trust services (like electronic signatures) across member states but does not govern the general right of individuals to access their personal data.
D. Database Service on Alternative Methods (DB-ALM): This is not a recognized data protection regulation. It appears to be a distractor term with no standing in the context of international data privacy law.

1. Official Journal of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). EUR-Lex. Article 15

"Right of access by the data subject

" Paragraph 1

states

"The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed

and

where that is the case

access to the personal data..."

Source: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679

2. European Commission. (n.d.). eIDAS Regulation. Shaping Europe’s digital future. The official EU page describes eIDAS as a regulation to "provide a predictable regulatory environment to enable secure and seamless electronic interactions between businesses

citizens and public authorities." It does not cover the data access rights described in the question.

Source: https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation

3. U.S. Securities and Exchange Commission. (2022). The Laws That Govern the Securities Industry: Sarbanes-Oxley Act of 2002. This official source describes SOX as a law that "mandated a number of reforms to enhance corporate responsibility

enhance financial disclosures and combat corporate and accounting fraud."

Source: https://www.sec.gov/answers/sox302.htm

4. Kamara

I. & de Hert

P. (2018). Understanding the Right of Access of the GDPR. In: Enforcing Privacy. Law

Governance and Technology Series

vol 37. Springer

Cham. This academic publication analyzes the GDPR's right of access

stating

"The right of access is a cornerstone of data protection. It is the right that allows data subjects to find out what data controllers know about them..." (p. 135).

DOI: https://doi.org/10.1007/978-3-319-70327-26