Articles 20 and 20-2: a controller processing information collected from others tells the data subject on request, immediately, the source, the purpose and the right to stop processing or withdraw consent; controllers meeting decree size criteria must notify these proactively when they obtained the information by consent-based provision; controllers meeting decree criteria periodically notify data subjects of how their information was used and provided, or how to view that history.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.