The purpose of processing is set in laws, regulations, statutes or other documents governing the controller and conforms to data protection law; processing is open and transparent, by means suited to that purpose, for specific and lawful purposes defined with the data subject's consent or provided by law; if the purpose changes to one incompatible with the original, the controller obtains consent for the new purpose unless a law provides otherwise.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.