Processing for law-enforcement purposes is lawful only where necessary for a competent authority's task and based on law (DSG s38), with the safeguards of ss42-61.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.