The organization must set and document objectives for minimising data, and the mechanisms that achieve them. It must show how both the particular data items and the volume gathered and handled are kept in proportion to the identified purposes. Where a purpose truly needs data that has not been de-identified, it must describe that processing; where it does not, it must document how far the data needs to stay linked to the individual and which mechanisms and techniques, generalisation or randomisation for example, are meant to deliver the de-identification or minimisation objectives promptly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.