The lawful basis for providing personal information to third parties is identified and met; consent for provision is sought with clear notice, separated from other consents and with legally important items highlighted; items provided are limited to the minimum for the purpose; provision uses secure procedures and is logged; third-party access to personal information is controlled by a protection procedure; and additional provision without consent follows criteria on relevance, foreseeability, harm and safeguards, published when recurring (PIPA Articles 17 and 22).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.