On receiving a product data request, a data holder may disclose requested voluntary product data but, if it does, must do so through its product data request service and under the data standards (civil penalty). It must, subject to the rule 2.5 refusal grounds, disclose the requested required product data through that service and under the standards, including any required product data on its website or in a disclosure document for the product (a Product Disclosure Statement, a key facts sheet or a similar document the law requires before contracting) (civil penalty). A data holder that offers a product on behalf of another data holder that contracts with the consumer need not disclose it; if they agree in writing, the offering data holder may disclose on the contracting data holder's behalf.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.