A controller in possession of de-identified data must take reasonable measures so the data cannot be associated with an individual, publicly commit to keep and use it without attempting re-identification, and contractually oblige recipients to comply with the chapter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.