Location data other than traffic data may be processed only if anonymised or with the user's or subscriber's prior consent, revocable at any time, to the extent and for the duration needed for the requested value-added service. Before asking consent the provider informs users of the type of location data, the purposes and duration and any transfer to a third party providing the service; consenting users keep the right to interrupt the processing temporarily, free of charge and simply, per connection or transmission. Only authorised persons of the provider or the third party may process the data, strictly as needed and identifiably.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.