Where data is obtained from another source, the controller must give the Article 14 information plus the categories of data and the source (including whether publicly available), within a reasonable period and at the latest one month after obtaining it, or at first communication, or at first disclosure to another recipient, and before any further processing for a new purpose. The duty does not apply where the data subject already has the information, where it is impossible or would take disproportionate effort (with protective measures such as public information), where a law expressly provides for obtaining or disclosure with safeguards, or where professional secrecy under law requires confidentiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.