It is an offence knowingly or recklessly to obtain or disclose personal data without the controller's consent, to procure disclosure to another person, or to retain data without the consent of the controller from which it was obtained, and to sell or offer to sell data so obtained; defences cover crime prevention, legal requirement or authorisation, public interest justification, reasonable belief in a right or in the controller's consent, and journalism in the public interest. Controllers are expected to prevent staff and third parties from obtaining or disclosing data without authority, and the court may order forfeiture or erasure of material.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.