Before or at collection the controller must tell the data subject, unless they already know: (1) the purpose of collection for use or disclosure, including purposes relying on section 24 without consent; (2) where providing the data is required by law or a contract or needed to enter a contract, that fact and the possible effect of not providing it; (3) the personal data to be collected and the retention period, or where that cannot be stated, the expected period under retention standards; (4) the categories of persons or entities to whom the data may be disclosed; (5) information, address and contact channels of the controller and, where applicable, its representative or data protection officer; and (6) the data subject's rights under sections 19 paragraph five, 30, 31, 32, 33, 34, 36 and 73.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.