Articles 76 and 78: GDPR fines are graduated by GDPR 83.2 criteria plus continuing infringement, link of the business to data processing, profits obtained, the data subject's own conduct, a later merger, impact on minors, voluntary DPO appointment and voluntary ADR; other corrective measures may apply; AEPD fines above one million euros on legal persons are published in the BOE; sanctions prescribe after one, two or three years depending on amount (up to 40,000, up to 300,000, above).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.