Where data comes from another source, the controller must also state the source and whether it was publicly accessible, and give the notice within a reasonable time and at the latest within one month, at the first communication with the person, or when the data is first disclosed to another recipient. The duty falls away where the person already has the information, where notice is impossible or disproportionate (notably for archiving, research or statistics, in which case the information is made public), where a law expressly provides for the obtaining or disclosure with safeguards, or where professional privilege or statutory secrecy applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.