The owner or operator may hand processing to a third party only with the subject's written (including electronic) consent, where needed to perform or fulfil a contract between the owner and the subject, or where legislation provides; the third party's protection duties apply from collection until destruction or depersonalisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.