Where the purposes do not require, or no longer require, identifying the data subject, the controller need not keep, obtain or process extra information only to comply with the Law. Where it can demonstrate that it cannot identify the data subject, it must inform the data subject where possible, and the rights in Articles 13 to 20 do not apply unless the data subject supplies additional information that enables identification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.