An individual is deemed to consent to collection, use or disclosure if the organisation, before doing so, conducts an assessment determining that the proposed collection, use or disclosure is not likely to have an adverse effect on the individual, identifying any likely adverse effect and implementing reasonable measures to eliminate, reduce or mitigate it; takes reasonable steps to bring to the individual's attention its intention, the purpose, and a reasonable period and manner in which the individual may opt out; and the individual does not opt out within that period. It cannot be used for prescribed purposes, including direct marketing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.