Architects and operators keep the individual's interests uppermost, for example through protective defaults, suitable notices and choices that are easy to use and put people in control. The best results come from designs built consciously around the interests and needs of users, who have the greatest stake in their own data, and empowering individuals to take an active part in managing their data may be the most effective check on its abuse and misuse. The principle is supported by four fair information practices: consent (free and specific consent is needed to collect, use or disclose personal information unless law permits otherwise, consent must be clearer and more specific the more sensitive the data, and it can be withdrawn later); accuracy (information is as accurate, complete and current as the specified purposes require); access (individuals can access their information, learn how it is used and disclosed, challenge its accuracy and completeness and have it amended); and compliance (complaint and redress mechanisms are established and publicised, including how to reach the next level of appeal). It goes further: interfaces between people and systems must be designed around people and easy to use, so that individuals can reliably make informed privacy choices, and business operations and physical architectures should show the same regard for the individual.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.