Controllers and processors, natural or juristic, may not collect, transfer, store, save, process or disclose sensitive personal data without a licence from the Centre and, except where the law authorises otherwise, the data subject's explicit written consent; for children's data the legal guardian's consent is required, and a child's participation in a game, competition or other activity may not be conditioned on providing more personal data than participation needs; the Regulations set the criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.