The controller may collect, use or disclose personal data only with the data subject's consent given before or at the time of the processing, unless this Act or another law permits it without consent. Consent is requested explicitly in writing or electronically unless that is impossible by nature. The request must state the purpose, be clearly separated from other matters, be easy to access and understand, use clear and plain language and not deceive or mislead about the purpose; the Committee may prescribe a form and wording. The controller must take the utmost account of whether consent is freely given, and may not make entering into a contract or receiving a service conditional on consent to processing that is not necessary for or related to it. Consent may be withdrawn at any time, as easily as it was given, unless a law or a contract that benefits the data subject restricts withdrawal; withdrawal does not affect processing already lawfully done. Where withdrawal will affect the data subject, the controller must tell them the consequences. A consent request that does not meet the chapter binds nobody and gives no basis for processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.