Processing respects the fundamental rights of data subjects and the rights the Law confers, the same rule binding third-party users (13.1); limits on the right can be set only by law (13.2); special measures for the data of children and adolescents are set by the Reglamento, who act through their legal representatives with exceptions guided by the child's best interests (13.3); private communications, telecommunications and computer systems may be opened, seized, intercepted or intervened only on a reasoned judicial order or the holder's authorisation, and data obtained in breach have no legal effect (13.4); personal data may be processed only with the data subject's prior, informed, express and unequivocal consent unless a law authorises otherwise (13.5); for sensitive data the consent is additionally in writing, and processing without consent is possible only where a law authorises it for important reasons of public interest (13.6); consent may be revoked at any time with the same formalities as its grant (13.7); data on criminal or administrative infringements may be processed only by the competent public entities, and cancelled records may not be supplied except to the judiciary or the prosecutor (13.8); the commercialisation of personal data is subject to the principles (13.9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.