Processing conforms to the law and collection by fraudulent, unfair or unlawful means is prohibited (4); processing requires the data subject's consent (5); data are collected for a determined, explicit and lawful purpose and not processed for another purpose not unequivocally established at collection, except historical, statistical or scientific activities under dissociation or anonymisation (6); processing is adequate, relevant and not excessive for the purpose (7); data are truthful, exact, as far as possible up to date, necessary, pertinent and adequate for the purpose, and kept securely only for the time needed for it (8); the owner and processor adopt the technical, organisational and legal measures needed to guarantee security, appropriate to the processing and the category of data (9); every data subject has administrative or judicial routes to claim and enforce their rights (10); cross-border flows are guaranteed a level of protection sufficient, or at least equivalent to the Law or to international standards (11). The principles bind everyone who intervenes in processing, are non-exhaustive, serve as interpretive criteria and as parameters for other provisions and to fill gaps (12).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.