Personal data must be relevant and limited to what is strictly necessary for the purpose, and processing must be adequate, necessary, timely, relevant and not excessive in relation to the purposes and to the nature of the special categories of data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.