Personal data must not be kept after the purpose of processing has been exhausted; it may be kept only if the data subject's identity has been concealed by anonymisation. The Executive Regulations may add further controls (Article 5(8)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.