Personal data is not disclosed, made available or otherwise used for purposes other than those specified under paragraph 9, unless the individual consents or the law authorises it. A controller therefore needs a gate on every secondary use and every disclosure to another party.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.