Before collection the data subject is told the nature and category of data, who is collecting it and their address, the purpose, whether supply is voluntary or mandatory and the consequences of not supplying it, the legal authority for collection, recipients, the rights of access and rectification, and the retention period; where collected from a third party, this is given before or as soon as practicable after collection, subject to law enforcement, national security, penalty, revenue and court exceptions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.