An operator or anyone processing personal information on behalf of a responsible party or an operator must process it only with the knowledge or authorisation of the responsible party, and must treat personal information that comes to their knowledge as confidential and not disclose it unless required by law or in the proper performance of their duties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.