Article 38: data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless necessary for a contract, authorised by law with safeguards, or based on explicit consent; in the contract and consent cases the controller ensures at least human intervention, the chance to express a view and to contest the decision; such decisions may not rest on special-category data unless explicit consent or substantial public interest applies with safeguards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.