Article 37: data subjects may object at any time on grounds relating to their situation to processing based on public tasks or legitimate interests, including profiling, and the controller stops unless it shows compelling legitimate grounds overriding their interests or needs the data for legal claims; objection to direct marketing, including related profiling, always ends such processing (continuing is fined at 100,000 dinars); the right is brought to their attention at the latest at first communication, clearly and separately; for research and statistics objection is limited where processing is needed for a public-interest task.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.