The controller must put in place a system to examine and carry out erasure or destruction of personal data when the retention period ends, when the data is irrelevant or beyond what the purpose needs, when the data subject asks, or when consent is withdrawn, except where retention serves freedom of expression, section 24(1) or (4) or section 26(5)(a) or (b) purposes, legal claims or legal compliance; the Committee's erasure rules under section 33 paragraph five apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.