When the specific purpose disappears or the period expires the agency must delete, or stop processing or using, the data on its own initiative or on request, unless needed for duties or business (for example a legal or contractual retention period, protecting the person's interests, or another proper reason) or the person consents in writing; purposes disappear on dissolution without a successor, change of business, completion of the purpose or other impossibility (ER 20). Data collected, processed or used in breach of the Act must be deleted or its use stopped on the agency's own initiative or on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.