In answering an access request a controller must not disclose a consumer's Social Security number, driver's licence or other government identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data, and must instead state with sufficient particularity that it holds them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.