Processing of sensitive data is prohibited unless adequate measures protect the data subject's rights and one ground applies: explicit consent for specified purposes (unless law says the prohibition cannot be lifted by consent); obligations or rights in employment, social security and social protection, including collective agreements; vital interests where the person cannot consent; legitimate activities of a non-profit body with a political, philosophical, religious or trade union aim, limited to members, former members or regular contacts and not disclosed outside without consent; data manifestly made public by the data subject where needed for a legitimate aim; legal claims or a substantial and proportionate public interest respecting the essence of the right; preventive or occupational medicine, diagnosis or health care by persons under professional secrecy; public health interests under legislation with secrecy safeguards; or public interest archiving, research or statistics under Article 45.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.