Article 13: where much data is held the controller may ask the data subject to specify the data or processing concerned; access is deemed granted by providing a remote, direct and secure system giving permanent access to all the data (the data subject may still ask for GDPR 15.1 information not shown); more than one access request within six months may be treated as repetitive unless there is legitimate cause; if the data subject chooses a disproportionately costly means, they bear the extra cost.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.