A controller must provide an appeal process for refusals, conspicuously available and similar to the request process, usable within a reasonable period after the decision. Within 60 days of receiving an appeal it must tell the consumer in writing what it did or did not do and why, and if the appeal is denied it must give the consumer an online mechanism, if available, or another method to complain to the attorney general.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.