Chapter II Sections 14-23 establish data subject rights and transparency obligations. Section 14 (Right to Information) requires controller to provide privacy notice at or before collection covering: identity + contact of controller + processor + DPO + purposes + lawful basis + recipients + transfers outside EU + retention + rights + complaint to NAIH + automated decision-making (Section 15). Section 16 (Right of Access) - data subject may request: confirmation of processing + categories + purposes + recipients + retention + source + automated decision-making logic + transfer details. 30-day response (extendable in complex cases by 30 days with notification). Section 17 (Right to Rectification) inaccurate data correction within 25 days; refusal in writing with reasons. Section 18 (Right to Erasure) right to be forgotten; mandatory erasure grounds. Section 19 (Right to Restriction). Section 20 (Right to Object) - including absolute right against direct marketing. Section 21 (Right to Data Portability) machine-readable format. Section 22 (Notification to recipients) + Section 23 (Compensation for damages). Aligned with GDPR Articles 13-22 + Hungarian timing specifics (25-day rectification vs GDPR 1 month). Hungarian timing: 25 days for response to access/rectification (faster than GDPR). HU Infotv Sections 14-23 + privacy notice + DAR + rectification + erasure + restriction + objection + portability + 25-day response applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.