A controller holding de-identified data must take reasonable measures to ensure it cannot be associated with an individual, publicly commit to maintaining and using it without attempting re-identification, and contractually obligate recipients to comply with all provisions of the chapter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.