When personal information comes from third parties, contracts state that the provider is responsible for obtaining consent; data from public sources is used only within the scope the data subject is reasonably taken to have allowed; minimisation applies to data generated automatically in service delivery; data subjects are told the source, purpose and right to stop processing on request and, where legal size or type thresholds apply, proactively; and records of such notices are kept until the data is destroyed (PIPA Articles 16, 19 and 20).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.