Where a breach is likely to result in a high risk to the rights and freedoms of a data subject, the controller immediately communicates it to the data subject in plain and clear language with advice on measures the data subject could take to mitigate the possible adverse effects; where direct communication would involve disproportionate effort or expense or is otherwise not feasible, the controller may instead make a public communication in one or more widely used media so that the data subject is likely to be informed; the Commission may itself make a public communication where it considers the controller's steps inadequate and is to publish regulations on the steps to inform data subjects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.