The law enforcement purpose of collection must be specified, explicit and legitimate and data must not be processed in a way incompatible with it. Data may be used for another law enforcement purpose, by the collecting or another controller, only where authorised by law and necessary and proportionate, and may be used for a non-law-enforcement purpose only where authorised by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.