A processor may process personal information only where the individual has consented; the processing is necessary to conclude or perform a contract to which the individual is party, or for human resources management under labour rules and collective contracts established according to law; necessary to perform statutory duties or obligations; necessary to respond to public health emergencies or protect life, health and property in emergencies; reasonable processing for news reporting, media supervision and other public-interest activities; reasonable processing under the Law of information the individual disclosed or that was otherwise lawfully disclosed; or other circumstances provided by law or administrative regulation; where other provisions of the Law require consent, consent must be obtained except in circumstances (2) to (7). There is no legitimate-interest basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.