A controller limits what personal data it collects and obtains it only by lawful and fair means. Where appropriate to the circumstances, collection happens with the knowledge or consent of the individual. The test is applied per data element: a collection that cannot be tied to a stated need, or that is done covertly or by deceit, fails the limit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.