Consumer rights and 501.71 duties do not apply to pseudonymous data or aggregate consumer information where the controller shows that identifying information is kept separately under effective controls preventing its access. A controller that discloses pseudonymous, deidentified or aggregate data must exercise reasonable oversight of recipients' contractual commitments and act on breaches.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.