Except where the Law allows, data may not be processed, nor its purpose changed, without consent (Law 5(1)); consent may be withdrawn at any time (Law 5(2)) and may not be made a condition of a service or benefit unless directly related to the processing consented to (Law 7). Consent may be written, verbal or electronic but must be freely given without misleading methods, for clear, specific purposes explained beforehand, given by a person with full capacity, documented with time and method so it can be verified, and obtained separately for each purpose; it must be explicit for sensitive data, credit data and decisions based solely on automated processing (IR 11). Withdrawal procedures are set up before consent is sought and are at least as easy as giving it; processing stops without undue delay on withdrawal, recipients are asked to destroy the data, and other legal bases are unaffected (IR 12). Legal guardians act in the best interests of those lacking capacity, their authority is verified, no harm may result, and the data subject can exercise rights on reaching capacity (IR 13).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.