Schedule 1 Part 15 adds APP 1.7: where an APP entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about the individual, its APP privacy policy must state the kinds of personal information used in the operation of such programs, the kinds of such decisions made solely by them, and the kinds of such decisions for which they do a substantially and directly related thing (APP 1.8). Making a decision includes refusing or failing to decide; effects may be adverse or beneficial; examples are statutory benefit decisions, decisions affecting contractual rights and decisions affecting access to a significant service or support (APP 1.9). It applies to decisions made after commencement, whenever the arrangement was made or the information obtained, and APP 1.7 is enforceable under s 13K(1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.