Personal data must be collected directly from the data subject; collection from third parties needs the consent of the data subject, heirs or guardian unless provided by law, direct collection would take disproportionate effort, it manifestly does not affect the person's legitimate interests, or the person has died. Breach is an offence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.