A controller that discloses pseudonymous or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments attached to it and take appropriate steps to address breaches of those commitments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.