Before personal data are obtained and used the data subject must be told expressly and clearly the purpose for which they will be used, and must consent expressly and unequivocally, in conditions leaving no doubt, recorded in writing, electronically, digitally or by another reliable mechanism. Consent may be revoked expressly, in the same way and free of charge, without retroactive effect. Processing or assignment of personal data without free, express and conscious consent is unlawful, and the controller bears the burden of proving consent. Article 21(c) and (q) make collection without sufficient information and use without informed and express consent infractions, and 21(r) use for a purpose other than the one authorised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.