An administrative fine up to HRK 50,000 applies to a controller/processor who fails to mark surveillance under Art. 27, fails to establish the automated access-logging system under Art. 28(4), or whose authorised persons use footage contrary to Art. 28(2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.