A controller disclosing pseudonymous or de-identified data must exercise reasonable oversight of compliance with the contractual commitments attached to it and act on breaches. Access, correction, deletion and portability rights do not apply to pseudonymous data where the controller shows the identifying information is kept separately under effective controls that stop it accessing that information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.