Processing, including of sensitive data and criminal records, for public interest archiving, historical, research, scientific or statistical purposes is a legitimate interest of the controller unless the data subject's rights prevail, and data collected for any purpose may be further processed for these purposes. Safeguards are required, including data minimisation and pseudonymisation (and anonymisation or at least pseudonymisation wherever the purpose can still be met), pseudonymising and where possible anonymising before handing data over for further processing, and measures ensuring the data are not used for measures or decisions about individuals without their explicit consent. Exceptions from data subject rights apply only where exercising them would seriously damage or prevent the purpose and are necessary, with the controller bearing the burden of proof.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.