The Licensee follows the State's data breach notification statute where that law applies, and whenever 6A requires it to notify the Commissioner, it also gives the Commissioner a copy of the notice it has sent Consumers under that statute.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.