A controller receiving information about a person informs them, directly or through the EEA exporter, promptly and within one month, of the controller's and manager's identity and contacts, the purpose of the transfer, the data types and the rights of deletion, access and correction; before transferring the data to a third party it informs them of the recipient or categories, purpose, data types and rights; exceptions apply where the person already knows, contact is unknown or disproportionate, confidentiality or law prevents it, or harm to life, journalism or others' rights would result.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.