A personal identification code (asmens kodas) may be processed only where one of the lawful grounds of Article 6(1) GDPR applies. It must never be made public, and it must never be processed for direct marketing (offering goods or services to persons, or asking their opinion of them, by post, telephone or other direct means, Article 2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.