The data subject is entitled to be informed whether personal information about them shall be, is being or has been processed, and to be furnished before entry of the information into the processing system or at the next practical opportunity with: a description of the personal information to be entered; the purposes of processing; the scope and method of processing; the recipients or classes of recipients; the methods used for automated access, if the data subject allows it, and the extent authorised; the identity and contact details of the controller or its representative; the storage period; and the existence of the rights to access and correction and to lodge a complaint with the Commission. Information supplied or declared must not be amended without prior notification of the data subject. The notice is not required where the information is needed under a subpoena, where collection and processing are for obvious purposes (performance of a contract or service, an employer-employee relationship) or result from a legal obligation. The IRR (section 34(a)) adds the existence of automated decision-making and profiling, processing for direct marketing, the basis of processing where not consent, meaningful information about the logic and consequences of automated access, and the right to object.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.