Article 9(1) requires that location data other than traffic data (precise position data e.g. cellular triangulation, GNSS, Wi-Fi positioning) relating to users / subscribers may only be processed when they are made anonymous, or with the consent of the users / subscribers to the extent and for the duration necessary for the provision of a value-added service. Article 9(2) requires the provider to inform users / subscribers, prior to obtaining their consent, of the type of location data which will be processed, of the purposes and duration of the processing, and whether the data will be transmitted to third parties. Article 9(2) further provides that users / subscribers shall be given the possibility to withdraw consent at any time and to temporarily refuse the processing for each connection or transmission.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.