Processing under Part III is lawful only if foreseen by law and necessary and proportionate for a task of the competent authority under Article 47. Further processing for another Article 47 purpose requires legal authorisation and necessity and proportionality; for other purposes only where a law expressly allows it, under Part II; and for archiving, research or statistics with the Article 45(3) safeguards. Sensitive data may be processed only where absolutely necessary with appropriate safeguards and only if specifically authorised by law (or absolutely necessary to protect vital interests), or where manifestly made public by the data subject or serving a purpose within the authority's competence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.