A controller holding de-identified data must take reasonable measures so it cannot be linked to a person, publicly commit not to reidentify it, and contractually bind recipients to the Act; a controller disclosing pseudonymous or de-identified data must monitor recipients' compliance with their contractual commitments and act on breaches. Pseudonymous data is outside the access and controller-duty provisions only where the identifying information is kept separately under effective controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.