Design processing procedures and ICT systems to minimize the PII processed and the number of stakeholders and people to whom it is disclosed or who have access; adopt need-to-know access limited to the PII necessary for official duties within the legitimate purpose; make the default (or offer as an option) interactions that leave principals unidentified, make their behaviour harder to observe and make the PII collected harder to link; delete and dispose of PII once the purpose has expired, there is no legal requirement to keep it or it is practical to do so.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.