A controller must limit collection of personal data to what is adequate, relevant and reasonably necessary for the purposes of processing, and those purposes must be disclosed to the consumer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.