The organization must not use personal data it processes under contract for marketing or advertising unless it has confirmed that the individual concerned gave consent beforehand, and it must not make that consent a precondition of the service. It must document how it meets the customer's contract terms, particularly where marketing or advertising is intended, and it should not press for marketing or advertising uses to be included where explicit consent has not been obtained fairly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.