Credit bureaus and users that pass on personal credit information obtained from public bodies verify, as Article 32(3) provides, that the recipient has the subject's consent (except Article 32(6) cases), and recipients do not provide it to third parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.