A data subject may ask the controller to review a decision based solely on automated processing that has or is likely to have an irreversible and continuous effect on their rights and freedoms under the Constitution (added in 2025) or any written law. The right does not apply where the decision is authorised by law or in a manner the Authority determines, based on consent, or necessary for a contract (the contract ground not being available for special categories), and in those cases the controller must apply the measures the Authority sets by rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.