3. Scenario Data Subject (Client) Issuer Data Controller (Server) Downstream Data Controller Resources Non-personal content, services,… Collected personal data Personal Data (PII) Non-certified Certified: cards request credential card request resource request personal data personal data resource request personal data personal data