The controller or processor requests personal data directly from the data subject; collection from another person, source or public institution is allowed only where the data is open to the public, the data subject deliberately made it public, the data subject consented to collection from another source, or the collection complies with the Law. Where data was not obtained from the data subject, the data subject may be told the source on request (article 18).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.