When collecting data the owner or operator must inform the subject of: its identity; the purpose of processing and its legal justification; the level of protection in the information system; whether the system has a conformity certificate and passed state expertise; the intended users, including systems the data will be exchanged with; and the subject's rights. Where provision of data is mandatory by law, the subject must also be told the legal consequences of refusing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.