Purposes must be determined, explicit, legitimate and communicated to the data subject, and data may not be processed for other purposes unless a new lawful basis applies. Further processing for a different purpose is allowed only if compatible with the original, judged on the collection context, the information given, the data subject's reasonable expectations from the relationship, the nature of the data, the consequences of the further processing and the safeguards in both operations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.