The data subject may request erasure, destruction or anonymisation where (1) the data is no longer necessary for its purposes; (2) consent is withdrawn and there is no other legal ground; (3) an objection under section 32(1) cannot be rejected, or an objection to direct marketing under section 32(2) is made; or (4) the data was processed unlawfully under Chapter II. This does not apply where retention is needed for freedom of expression, section 24(1) or (4) or section 26(5)(a) or (b) purposes, legal claims or legal compliance. A controller that has made the data public must bear the technical means and cost of fulfilling the request and inform other controllers to obtain their response. The data subject may complain to the expert committee if the controller fails to act; the Committee may set erasure rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.