Article 11: controllers may meet GDPR Articles 13 and 14 by giving basic information (controller identity and representative, purpose, and how to exercise rights under GDPR 15 to 22, plus any profiling and the right to object to automated decisions) and an electronic address or other means to access the remaining information simply and immediately; where data were not obtained from the data subject, the basic layer also states the data categories and sources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.