Sources of privacy risk where an IoT system collects or processes PII; the text is not held. The introduction fixes the direction: laws and regulations usually apply to acquisition, storage and processing of PII, and even where they do not, theft or misuse of PII by an IoT system is a reputational and trust concern that can harm the people identified; 6.1 names ISO/IEC 29134 for the impact assessment and 5.2 names consumer IoT as the case where privacy is often critical. The privacy controls of 7.2 (now held in translation) show which sources they answer: indirect collection, identifiability of a device owner through monitoring, automated decisions, unclear accountability among stakeholders, and consent that outlives its need.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.