A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects the person, unless it is necessary for a contract, authorised by law with suitable safeguards, or based on explicit consent. Automated evaluation of personal aspects must not be based on special categories. Where an exception applies, the collection notice under section 23 discloses the existence and envisaged effects of such decisions, and for the contract and consent exceptions the controller implements suitable safeguards for the person's rights, freedoms and legitimate interests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.