A data subject who proves his or her identity may obtain from the controller, at reasonable intervals, without delay and free of charge, confirmation of whether data about him or her is processed with at least the purposes, categories of data and recipients, communication of the data in intelligible form with any available information on its source, and knowledge of the logic of any automated processing. The controller may ask the CNDP to set response times for legitimate requests and may object to manifestly abusive requests, notably by number or repetition, bearing the burden of proof. Where a request cannot be met immediately the controller gives a dated, signed acknowledgement stating the reason and refers the matter immediately to the CNDP to fix a deadline (Decree Article 36(2)). Refusing access is an offence (Article 53).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.