When a subject applies on Form No. 4 to stop or not begin processing likely to cause substantial damage, the controller or processor must within 72 hours, without charge, acknowledge, suspend processing, flag the data as restricted and tell third-party recipients to suspend; within 7 days it decides, and if it accepts it removes the data and has third parties stop using it, or if it rejects it gives written reasons (the subject then has 14 days to complain).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.