Special category data may not be processed except where processing is mandatory by law, the subject has given written consent (including through the e-government system, added in 2024), the data is open under Article 5.3, it is needed to protect the life and health of the subject or others and consent cannot be obtained, or it concerns members of a public association or non-profit processed for its lawful aims and not passed on without consent. When the grounds cease, the data must be blocked at once and, unless the subject agrees to its storage or archiving, destroyed without delay.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.