Data subjects have the right not to be subject to a decision based solely or partly on automated assessments, including profiling, that produces legal effects on them or harms their fundamental rights and freedoms; they may ask the controller for a reasoned explanation, make observations, request the assessment criteria of the automated programme, ask which types of data were used and their source, and challenge the decision before the controller or processor. The right does not apply where the decision is necessary to enter into or perform a contract with the controller, is authorised by law, court order or reasoned decision of a competent authority with safeguards, rests on explicit consent, or carries no serious impact or verifiable risk. The right may not be waived in advance in mass adhesion contracts, and it must be expressly communicated at the latest at the first communication informing of a solely automated decision.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.