Articles 54 and 55: before processing likely to result in high risk, especially with new technologies, the controller assesses the impact, with the DPO's advice; it is mandatory for systematic and extensive automated evaluation including profiling with significant effects, large-scale special-category or criminal data, and large-scale systematic monitoring of publicly accessible areas, and for types on the Commissioner's published list; the assessment describes the processing and interests, necessity and proportionality, risks and mitigating measures; where it shows high residual risk, the controller seeks the Commissioner's opinion before starting, supplying roles, purposes, measures, DPO contacts and the assessment, and the Commissioner answers within 60 days, extendable by 45.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.