Once an access or portability request has been made (UK GDPR Articles 15 and 20, sections 45 and 94), it is an offence for the controller or anyone employed by or acting under it to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure of what the requester would have been entitled to receive, unless it would have happened anyway or the person reasonably believed the requester was not entitled.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.