Data subjects may not be subjected to a decision based solely on automated processing, including profiling, with legal or similarly significant effects unless it is necessary for a contract, authorised by a law with safeguards, or consented to. A data subject may object to processing based on public authority or archiving and research grounds that causes unwarranted substantial damage or distress, after which the controller must stop unless it shows overriding public interest or legitimate grounds.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.