The owner and the processor, as the case may be: process personal data only with the data subject's prior informed, express and unequivocal consent, unless a law authorises otherwise or an article 14 case applies; do not collect data by fraudulent, unfair or unlawful means; collect data that are up to date, necessary, pertinent and adequate for determined, explicit and lawful purposes; do not use the data for purposes other than those for which they were collected unless anonymised or dissociated; store the data so as to allow the data subject to exercise their rights; erase and replace or complete data known to be inaccurate or incomplete without prejudice to the data subject's rights; erase data no longer necessary or pertinent or whose processing period has expired unless anonymised or dissociated; provide the National Authority with the information on processing it requires and allow it access to the data banks they administer in a pending administrative procedure requested by the affected party; and meet the other obligations of the Law and the Reglamento.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.