Unless the part provides otherwise, a controller may not process personal data for a purpose that is neither reasonably necessary for nor compatible with the purposes disclosed to the consumer, unless it obtains the consumer's consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.