Limit use, retention and disclosure including transfer to what is necessary for specific, explicit and legitimate purposes; limit use to the purposes stated before collection, unless the law expressly requires some other purpose; retain PII only as long as necessary and then securely destroy or anonymize it; lock (archive, secure and exempt from further processing) PII whose purposes have expired but which the law requires to be retained; and know the additional national or local requirements when PII is transferred internationally.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.