A controller holding de-identified data must take reasonable measures to ensure it cannot be associated with an individual, publicly commit to maintaining and using it without attempting re-identification, and contractually bind recipients to comply with the Act. The Act does not require re-identification or keeping data in identifiable form, nor compliance with a request the controller cannot reasonably link to the data where it neither uses the data to recognise the consumer nor sells or discloses it beyond processors; and the access, correction, deletion and portability rights do not apply to pseudonymous data where the controller shows that identifying information is kept separately under effective controls that prevent its access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.