A data subject may appeal to the Authority, as prescribed, against a refusal of access, of consent withdrawal or objection, of rectification, of erasure, a refusal under section 17(2) or a refusal to review an automated decision; the Authority decides whether the refusal was lawful and informs both sides within a prescribed period. Where an appeal is allowed the controller must implement the decision within the time set and report the steps taken to the data subject and the Authority; either party may appeal to the Court of Appeal within thirty days.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.