Whether a natural person is identifiable is judged on all the means that can reasonably be used by the holder or any other party to identify them: identifiers (4.4.1), other distinguishing characteristics (4.4.2), information that is, or could be, tied to a principal (4.4.3), pseudonymous data, which remains PII where re-identification is reasonably possible (4.4.4), metadata (4.4.5), unsolicited PII received without being asked for, which should be handled as PII or disposed of (4.4.6), and sensitive PII, whose nature warrants special protection (4.4.7).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.