A CSP presents internationally and collects attendee emails in the EU.Which regulation governs how that data must be handled?