Personal data must be used for its intended purpose; other uses (and any disclosure to someone other than the data subject) are allowed only with the subject's authorisation, where law requires or authorises it, for a directly related purpose, in non-identifying form or for unpublished statistics or research, or to prevent a serious and imminent threat to life, health or public safety.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.