An organisation must not collect, use or disclose personal data unless the individual gives or is deemed to give consent, or the collection, use or disclosure without consent is required or authorised under the Act or other written law (13); consent is not given unless the individual was provided the section 20 information and consented for that purpose; an organisation must not, as a condition of providing a product or service, require consent beyond what is reasonable to provide it, nor obtain consent by false or misleading information or deceptive or misleading practices, and consent so obtained is invalid; consent may be given by a person validly acting on the individual's behalf (14).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.