> I'm not extremely familiar with the letter of the law, but if it doesn't specify that you need 2FA/email The Regulation doesn't mandate specific technical im

> I'm not extremely familiar with the letter of the law, but if it doesn't specify that you need 2FA/email The Regulation doesn't mandate specific technical implementations anywhere; it leaves that to the industry, which is the expert in that regard. But on the subject of the Right of Access it does explicitly say: "The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers" It seems to me that not using 2FA/email means they haven't used all reasonable measures to verify the identity.