The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, producing legal or similarly significant effects, unless necessary for a contract, authorised by law with safeguards, or based on explicit consent. For contract and consent cases the controller must implement safeguards including at least the right to human intervention, to express a view and to contest the decision; such decisions may not rest on special category data unless explicit consent or substantial public interest applies with safeguards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.