The assessment must weigh the benefits of the processing to the controller, consumer, other stakeholders and the public against the risks to consumers' rights as mitigated by safeguards, and factor in the use of deidentified data, consumers' reasonable expectations, the context of processing and the controller-consumer relationship. One assessment may cover comparable operations, and an assessment done for another law counts if reasonably comparable in scope and effect. Disclosure to the Attorney General does not waive privilege (501.713(3)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.