Schedule 1, 4.3: the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.