Controllers and processors must not disclose personal data they learn to anyone contrary to the Law or use it for purposes other than processing, and this obligation continues after they leave their posts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.