Where express consent is needed, the agency must obtain it at or before processing (or, for a new purpose, after collection but before use), tell individuals at collection if data may be shared with another agency for another purpose, not make consent beyond what is reasonable a condition of a service or scheme, not obtain it by deception or misleading or incomplete information, and obtain it directly from the individual or a valid representative.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.