For personal data collected before the Act came into effect (1 June 2022 for the substantive chapters after two postponements), the controller may continue to collect and use it for the original purposes, but must prepare and publicise a method for withdrawing consent so a data subject who does not want the collection and use to continue can easily say so. Disclosure and any other act beyond collection and use must follow the Act.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.