Except where the law provides otherwise, processing requires the data subject's express written consent (for incapable persons, general law applies), which may be withdrawn at any time; consent is not needed where processing is manifestly in the data subject's interest and contact is impossible, would take disproportionate effort, or is provided for by law or a contract with the data subject. Consent for one form or purpose does not extend to others, and processing for advertising requires express and specific consent. Processing without the required consent is an offence (two years and 10,000 dinars).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.