The controller publishes on the authority's website, in plain language, the purposes of processing, the rights of access, rectification, erasure and restriction, the identity and contact details of the controller and DPO, the right to complain to the Authority and the Authority's contact details (Article 53 as amended). In specific cases, notably covert collection, the data subject is also informed of the legal basis, the retention period or criteria, recipients and further information, which may be delayed, restricted or omitted where necessary for the authority's tasks, national or public security or third parties' interests (Article 54).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.