Articles 35 and 38 with Decree: data subjects may request access to (and copies of) their personal information, from public institutions directly or through the Commission; the controller allows access within ten days under the decree or explains a justified delay; it may restrict or refuse only where a law forbids, where others' life, body or property would be harmed, or where listed public functions would be seriously impaired; requests may be made through a representative, legal guardians act for children under 14, fees must be reasonable, methods must be no harder than collection, and an objection procedure must be offered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.