A controller must keep collection adequate, relevant and reasonably necessary for the purposes disclosed to the consumer and must not process for purposes neither reasonably necessary to nor compatible with those disclosed purposes without consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.