Where a data subject is a child (under 18 per the Child's Right Act) or a person lacking legal capacity to consent, the controller obtains the consent of the parent or legal guardian to rely on consent, and applies appropriate mechanisms to verify age and consent taking available technology into account, presentation of a government-approved identification document being an appropriate mechanism; parental consent is not required where processing is necessary to protect the child's vital interests, is carried out for education, medical or social care under a professional owing a duty of confidentiality, or is necessary for court proceedings relating to the individual; the Commission is to regulate the case of children of 13 and above requesting information society services; nothing authorises processing inconsistent with the Child's Right Act.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.