When personal data are not collected from the data subject, the controller must inform that person personally and expressly of the content of the data, the purposes of processing and the right to object to it. The duty lapses where the person already knows or informing them is impossible or needs effort disproportionate to the benefit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.