A State body may deny or limit access to public information only to prevent specific harm to personal data interests where that harm outweighs the public interest, and not where the person consented, the data were supplied for disclosure, are publicly available or public by law, a court orders publication, national security or general health requires it, or they pass between public entities for their powers. A body that finds a request may affect personal data must notify the data subject within three business days; the data subject has five working days to object, the body then seeks the supervisory authority's non-binding opinion (given within five working days) and decides within five business days, notifying within three business days if it grants access despite objection, with judicial remedies under Law No. 5282/2014.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.