Apply Section 4.2-4.5 PII minimisation principles: collect only PII necessary + purpose limitation + storage limitation + accuracy + record retention per NARA schedule + secure disposal. Implement Section 5 de-identification techniques: pseudonymisation + anonymisation + aggregation + suppression + masking + differential privacy + k-anonymity + l-diversity + t-closeness + synthetic data generation. Reference NIST IR 8053 De-Identification of Personal Information + NIST SP 800-188 De-Identifying Government Datasets + NIST IR 8214A Threshold Schemes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.