The European Union’s General Data Protection Regulation (GDPR) grants data subjects the right of access, meaning that an EU citizen may request a copy of all of their personal data collected by an organization. Businesses have one calendar month to comply to such requests—and by extension, ensure the person issuing a request is who they say they are.
It’s not an exactly a foolproof process. Last week, for instance, BBC News reported that an University of Oxford researcher was able to obtain his fiancee’s Social Security number, credit card information and account logins by calling around to different businesses.
