The collection purpose must relate directly to the Controller's purposes and be lawful; collection methods must be lawful, suited to the data subject's circumstances, direct, clear and secure, without deception, misleading or extortion; content is limited to the minimum necessary and identifying content is avoided once the purpose is met; when data is no longer needed the Controller stops collecting and destroys what it has without undue delay (Law 11). The Controller collects only data directly related to the purpose, determined through means such as data maps, and retains only the minimum needed (IR 19).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.