A controller must provide a conspicuously available appeal process, similar to its request process, for refusals; within 60 days of an appeal it must tell the consumer in writing what it did or did not do and why and, on denial, provide an online mechanism if available or another method to complain to the attorney general.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.