The controller may not collect personal data from any source other than the data subject unless (1) it informs the data subject of the indirect collection without delay, and not later than thirty days from collection, and obtains consent, or (2) the collection falls within the consent exceptions in section 24 or section 26. The new-purpose rule of section 21 and the notice of section 23 apply to consent-based indirect collection, except where the data subject already knows, the controller can show notice is impossible or would obstruct use or disclosure (particularly for scientific, historical or statistical research, with suitable safeguards), use or disclosure is urgent as required by law with safeguards, or the controller learned the data through duty, occupation or profession and must keep the purpose or details confidential by law. The notice is given within thirty days of collection, or at the first communication where the data is used to communicate with the data subject, or before the first disclosure where disclosure is envisaged.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.