Where a significant decision about a data subject is based wholly or partly on personal data and solely on automated processing, the controller must ensure safeguards that inform the data subject of the decision, enable representations, enable human intervention by the controller and enable the decision to be contested, plus anything regulations add. The safeguards may be dispensed with only where exemption is required to avoid obstructing inquiries, prejudicing crime prevention or prosecution, protecting public or national security or protecting others' rights, and the controller reconsiders the decision as soon as reasonably practicable with meaningful human involvement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.