After surrender or revocation, the person must keep complying with privacy safeguards 6, 7 and 12 as if still an accredited data recipient (civil penalty). After surrender, revocation or during suspension it must not seek to collect any further CDR data, and must notify each consumer who consented to collection that its accreditation has been surrendered, suspended or revoked and, for a suspension, that consents to collect and use may be withdrawn and the effect of withdrawal (civil penalty). After surrender or revocation it must delete or de-identify collected CDR data under rule 7.12 or 7.13 unless the law or a court or tribunal order requires retention or the data relates to current or anticipated legal or dispute resolution proceedings of it or the consumer (civil penalty), and may rely on the consumer's statement about proceedings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.