A public body may collect personal information only if authorised by written law, for law enforcement, or directly related to and necessary for an operating programme, and must collect it directly from the individual unless the individual, the Commissioner or law authorises otherwise or it is needed for medical treatment, awards, proceedings, debt collection or payments, or law enforcement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.