Present the principal with the choice whether to allow processing except where consent cannot freely be withheld or the law allows processing without it, the choice given freely, specifically and on a knowledgeable basis; obtain opt-in consent for sensitive PII; inform principals of their participation and access rights and give them the openness-principle information before consent; explain the implications of granting or withholding; let consent be withdrawn easily and free of charge, exempting the PII from processing not legally mandated; notify the principal where another legal basis is used; for the controller, mechanisms for exercising choice that are clear, prominent, easy to understand and to reach, and affordable at collection or first use, and implementation of the expressed preferences; and comply with the additional provisions (minors, international transfers) before processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.