A controller may not collect additional categories of personal information, or use collected information for additional purposes, without first giving notice consistent with 501.711.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.