A data subject may not be subjected to a decision with legal consequences or that affects them to a substantial degree based solely on automated processing intended to provide a profile (performance at work, creditworthiness, reliability, location, health, personal preferences or conduct), unless the decision is taken in connection with the conclusion or execution of a contract and the data subject's request has been met or appropriate measures protect their legitimate interests, or the decision is governed by a law or code of conduct specifying such measures; the measures must give the data subject an opportunity to make representations and require the responsible party to provide sufficient information about the underlying logic to enable them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.