Personal data processed under 501.716 to 501.718 may be used only for those purposes, to the extent reasonably necessary and proportionate, adequate, relevant and limited, or to assist another party with them. Data kept under 501.717(1) must be protected by reasonable administrative, technical and physical measures, and the controller or processor bears the burden of showing that the exemption applies and the section is met.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.