A controller must provide at least two secure, reliable and clearly and conspicuously accessible methods for consumers to submit rights requests, designed around how consumers normally interact with it, secure communication and its ability to authenticate. It may not require a new account (it may require an existing one), and must offer a mechanism on its website to request information the part requires to be disclosed; an online-only controller with a direct relationship may also offer an email address.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.