On a data subject's request, after checking it is well founded, the controller of the data bank must rectify, delete or update the data within ten business days of the claim or of noticing the error; failure opens the habeas data action without further requirement. Where data were disclosed, the recipient must be told of the correction within five business days. Deletion does not proceed where it would harm third parties' legitimate rights or a legal or contractual duty requires retention. While a claim is under review, any information supplied about the claimant must state that it is under review or challenge. Correction of inaccurate or incomplete data is free of charge.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.