The data subject is entitled to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of their personal information; the IRR (section 34(f)) adds that any violation of the data subject's rights and freedoms is taken into account, and the Commission may award indemnity in its quasi-judicial proceedings (IRR section 64, Act section 37 on restitution).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.