Personal data may only be disclosed for purposes directly related to the legitimate interest of the controller and the recipient, and with prior consent of the data subject, who must be informed of the purpose and identify the recipient.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.