Controllers, processors and anyone involved at any stage of processing are bound by a duty of confidentiality that continues after their relationship with the data subject ends, lifted only by court order or legal obligation; breach is a serious offence (Article 45(32)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.