Is there any law that requires private companies to divulge the information they know/posses about you when formally requested?

Question

In the U.S., Is there any Federal or State law that compels private entities to hand over the information they have about the requester? If there is, what would be the penalties for not complying with an order to divulge that information?

For example; Bob wants to know what information a company like Sony possess about him between his product registrations, PS4 accounts and any other type of account that would fall under the "Sony" umbrella. So Bob follows what ever "formal" process Sony has put in place to make this type of request. At which point Sony refuses to give up the information.

Clarification Update: I'm not asking about deleting data. My context is simply on the "What information does the company have on me".

Answer 1

It depends what you mean by "in the US". I am a resident of the European Union. As such, the GDPR regulations apply to any individual or company that processes my personal information. I can demand that Sony Corporation of America tells me about any information it holds on me.

Note that this will probably work with Sony Corporation of America (who probably have enough dealings with the EU to have some assets within the jurisdiction of EU courts). It probably won't work with a one-man company who probably doesn't have any international assets.

Note also that this won't tell me about any information that Sony Electronics USA Inc. holds on me. They are distinct legal persons, despite the fact that Electronics is a wholly owned subsidiary of Corporation.

Answer 2

Except if compelled by court order, Sony (etc.) is not required to reveal whatever information they have (that is what I assume you mean by "turn over": if you mean "and destroy their copy", you have even fewer options for compelling "turning over"). You can require disclosure of your medical records from your health care provider; you can require disclosure of your student records from a qualified educational institute (it depends on them getting federal funds). You can indirectly get some information via your credit report (which comes not from Sony, but from Experian / Transunion / Equifax).