Personal information must be collected for a specific, explicitly defined and lawful purpose related to a function or activity of the responsible party, and steps must be taken under section 18 to make the data subject aware of the purpose unless a section 18(4) exception applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.