Subject to section 44, a controller may collect personal data only for a lawful purpose connected with its functions or activities and only where collecting the data is necessary for that purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.