Schedule 1, 4.5: personal information must not be used or disclosed for purposes other than those for which it was collected, except with consent or as required by law, and retained only as long as necessary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.