Consent applies to every activity in the processing procedure unless the law provides otherwise, and is valid only when given voluntarily with clear awareness of the categories of data processed, the purposes, the organizations and individuals allowed to process, and the data subject's rights and obligations; it must be expressed clearly and specifically in writing, by voice, by ticking a box, by a consent syntax, by technical settings or another affirmative action, in a format that can be printed, reproduced or verified; consent is per purpose, with multiple purposes listed so the data subject can agree to each; silence or non-response is not consent; partial and conditional consent are allowed; the data subject must be told when sensitive personal data is to be processed; consent stands until the data subject decides otherwise or a competent agency requests in writing; in a dispute the controller and controlling and processing entity bear the burden of proving consent; and an authorised person may act for the data subject where the data subject knows and consents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.