A controller that discloses pseudonymous or de-identified data must exercise reasonable oversight of compliance with the contractual commitments attached to it and take appropriate steps to address breaches of them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.