Personal data must be collected and processed lawfully under the Law and other applicable law. The controller must not obtain or process data by deceptive or fraudulent means and must give priority to the data subject's interests and reasonable expectation of privacy, meaning the trust a person places in another that the data provided will be processed as agreed under the Law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.