A controller whose purposes do not or no longer require identification need not keep or obtain extra information solely to comply with the Law. Where it can show it cannot identify the data subject it must inform the data subject if possible, and Articles 16 to 21 then do not apply unless the data subject provides additional information enabling identification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.