The data subject may object to decisions resulting from automated processing, including profiling, especially those with legal effect or adverse effect on them, unless the automated processing is agreed in their contract with the controller, required by other UAE legislation, or based on their prior consent under Article 6. In those excepted cases the controller must adopt measures to protect privacy and confidentiality without prejudicing the data subject's rights, and in all cases must include human review of automated decisions at the data subject's request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.