The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or significant consequences, unless the decision is based on the data subject's explicit consent, is necessary for entering into or performing a contract between the data subject and the controller, or is authorised by law with suitable safeguards for the data subject's rights, freedoms and legitimate interests; automated processing evaluating personal aspects may not be based on sensitive personal data unless an article 10 ground is met.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.