Collection must be for a declared, specified and legitimate purpose: consent is required before collection and processing subject to the Act's exemptions, must be time-bound in relation to the purpose and may be withdrawn; the data subject must be given specific information on the purpose and extent of processing including automated processing for profiling, direct marketing and data sharing; only necessary and compatible personal data may be collected. Processing must be fair and lawful, uphold the rights to refuse, withdraw consent or object, be transparent and in clear and plain language, and be limited to what is necessary. Data quality must be ensured. Personal data may be retained only as long as necessary for the purpose, for legal claims, or for legitimate business purposes consistent with industry standards or approved by a government agency, or as provided by law, and must be disposed of securely so as to prevent further processing, unauthorized access or disclosure; further processing for historical, statistical or scientific purposes and aggregated or de-identified data may be kept longer, but personal data must not be retained in perpetuity in contemplation of a possible future use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.