The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, unless the decision is necessary for a contract with the controller, authorised by a law laying down safeguards, or based on consent. Automated decisions on sensitive data require explicit consent or a legal provision under Article 9(2) with safeguards. In the permitted cases the controller must apply suitable safeguards, including the right to obtain human intervention, to express a point of view and to contest the decision.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.