The controller has an organisational, technological or other mechanism ensuring the database holds no data no longer needed for its purpose or other lawful retention, and deletes such data as early as possible unless anonymised or needed for the listed purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.