Controllers, processors and their employees are bound to maintain data secrecy, only transmitting personal data on lawful instruction, with the obligation persisting after the employment relationship ends (DSG s6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.