Article 19: data on criminal convictions, offences and security measures may be processed on an Article 12 basis only under the control of a competent authority or where a law allows it with specific safeguards; the single criminal record is kept only by and under the control of the competent authority. Article 20 relieves a controller that no longer needs to identify the data subject from acquiring extra data just to comply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.