Where data is not collected from the data subject, the controller or representative must give at least the identity, purposes and further information before recording the data or, if communication to a third party is planned, at the latest at the first communication, unless the person already knows. The duty does not apply to data necessary for national defence, state security or crime prevention, where a law expressly provides for recording or communication, to exclusively journalistic, artistic or literary processing, or where informing proves impossible (notably for statistical, historical or scientific processing), in which case the controller must notify the CNDP of the impossibility and its reason.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.