A controller must limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the purposes for which it is processed, as disclosed to the consumer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.