No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information unless it first: (1) informs the subject in writing of the collection; (2) informs the subject of the specific purpose and length of term for which the data will be collected, stored, and used; and (3) receives a written release from the subject (Section 15(a)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.