Article 32: when rectifying or erasing, the controller must block the data, identifying and reserving it with measures that prevent any processing including viewing, except making it available to courts, prosecutors and competent authorities (notably data protection authorities) for possible liabilities and only for their limitation period, after which it is destroyed; blocked data may not be used for anything else; where systems cannot block without disproportionate effort, a secure copy with digital evidence of authenticity, blocking date and non-manipulation is made; authorities may set exceptions. Breach of blocking is a very serious infringement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.