A processor must on its own initiative delete personal information, and the individual may demand deletion where it fails to, when the purpose has been achieved or cannot be or the information is no longer necessary, when the processor stops providing the product or service or the storage period expires, when the individual withdraws consent, when the processor processed in violation of law, regulation or agreement, or in other circumstances law provides; where a statutory storage period has not expired or deletion is technically difficult, the processor stops all processing other than storage and necessary security protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.