A controller holding personal data obtained from a source other than the consumer complies with a deletion request if it keeps a record of the request and the minimum data needed to keep the data deleted, and uses that retained data for no other purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.