The controller may not use or disclose personal data without consent unless it was collected without consent under section 24 or section 26. A person who receives data through such a disclosure may not use or disclose it for any purpose other than the one stated to the controller when requesting it. Where the controller uses or discloses data exempt from consent, it must record that use or disclosure in the section 39 record.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.