When collecting data directly, controllers tell data subjects at least their name and address and those of any representative, the purposes, the free right to object to direct marketing, whether replying is compulsory and the consequences of not replying, and as needed the recipients and the rights of access and rectification. When data come from elsewhere, similar information (including data categories) is given when recording or before disclosure to third parties or first direct marketing use, unless impossible, disproportionate (for example statistics, research or public health examination) or the recording is required by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.