Using information about a person's private affairs, or passing it to another, for a purpose other than the one it was given for is an infringement of privacy; the Head of the Authority may order a controller or holder to stop such use (section 23KE(a)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.