A public body may process personal data for a purpose other than the one collected for only where necessary for its tasks and necessary to verify information believed incorrect, prevent risks to national security, defence or public security or secure tax and customs revenue, prosecute criminal offences, prevent serious harm to another's rights, or produce official statistics; special categories additionally need an Article 9(2) GDPR or Article 22 exemption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.