At registration, and at least annually or as the Division requires, a data broker or data collector must submit: its name and primary physical, email and website addresses; whether and how individuals can opt out of its collection practices (method, type, limits and whether an authorised third party may opt out for them); whether individuals can direct deletion; a statement of the collection, databases or sales activities from which no opt-out is possible; whether it credentials purchasers of data and how; its history of data breaches and other cybersecurity events with the number of individuals affected (not published by the Division); a separate statement on practices, databases, sales and opt-outs for personal data of persons under 18 and whether it knowingly holds such data; any information the Division requires by regulation; and the processors that process personal data on its behalf. Failure to submit or update is $2,500 per day (section 4b).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.