Personal data is not collected, held or processed in a way that infringes privacy; it is collected directly from the data subject unless it is in a public record, was made public by the subject, the subject consented, collection elsewhere will not prejudice privacy, is needed for law enforcement, revenue, court proceedings or national security, or direct collection would prejudice a lawful purpose or is impracticable; and it is collected for a lawful, specific, explicitly defined purpose related to the controller's functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.