Before collecting personal data directly from a data subject the controller informs them of its identity, residence or place of business and means of communication (and of its representatives where necessary); the specific lawful basis under section 25(1) or 30(1) and the purposes; the recipients or categories of recipients; the existence of the Part VI rights; the retention period; the right to lodge a complaint with the Commission under section 46(1); and the existence of automated decision-making including profiling, its significance and envisaged consequences and the right to object to and challenge it. Where data is obtained other than directly, the same information is given unless the data subject already has it or providing it is impossible or a disproportionate effort or expense. The information is contained in a privacy policy expressed in a clear, concise, transparent, intelligible and easily accessible format suited to the class of data subjects targeted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.