A controller must provide a conspicuously available appeal process similar to its request process; within 60 days of an appeal it must tell the consumer in writing what it did and why, and on denial give an online mechanism, if available, or other method to complain to the Attorney General.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.