Where personal data is provided to a person or legal entity other than the controller, the controller must act to prevent that person from using or disclosing it unlawfully or without authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.