Beyond Art. 20, sensitive data and data of children and adolescents may not be processed without the express authorisation of the data subject or legal representative, unless the processing safeguards an essential public interest meeting human-rights standards, legality, proportionality and necessity, with specific safeguards. Adolescents from 15 may give their own explicit consent when the purposes are clearly specified (the Reglamento requires clear, age-appropriate information; a representative may also consent for an adolescent over 15, who may revoke it, but the representative cannot revoke the adolescent's own consent); under 15, consent comes from the legal representative, and for sensitive data or automated decisions about minors the representative's express consent is required; any consent that undermines the child's best interests is invalid. Children and adolescents under 15 exercise their rights through their representatives, from 15 directly. The State, schools, civil society, information-society service providers and others must provide information and training on the responsible processing of children's data to them and their representatives, following the Authority's technical rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.