The collecting entity holds a licence or permit as controller or processor; collects personal data only after the data subject's consent and clear information about the purpose, a natural person's provision of data in the course of a legitimate service or transaction counting as consent for that purpose and no other; obtains the Centre's approval of its collection mechanisms and of the mechanism for obtaining consent, including a guardian's consent for children; sets the retention period per purpose; binds those who collect data to confidentiality; informs data subjects of their Article 2 rights; applies the Centre's security procedures and programmes to data, devices and media; and keeps a secure electronic record of each consent with its date and format, the categories of data collected and the scope of use, the retention period per category and its relation to the purpose, and the organisational and technical security procedures that let the Centre inspect.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.