Location data (other than traffic data) about a user or subscriber may be processed only where the person cannot be identified from it, or where necessary for a value added service with that person's consent. Before seeking consent the provider must say what types of location data will be processed, for what purposes and how long, and whether the data will go to a third party to provide the service. Consent can be withdrawn at any time and the person must be offered, simply and free of charge, the chance to withdraw it at each connection or transmission. Processing may be done only by the provider, the third party providing the value added service or someone acting under their authority, and for a value added service only as far as necessary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.