Where express consent was needed, the agency must let the individual withdraw it on reasonable notice (subject to legal, contractual or public-interest restrictions), explain the likely consequences, and then stop collecting, using or disclosing the data unless another basis under paragraph 5 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.