As replaced by Law 5002/2022, special categories are processed by competent authorities only where strictly necessary for the Article 43 purposes and expressly provided by national or Union law, or to protect vital interests, or where the data were manifestly made public by the data subject, with safeguards such as specific security and control requirements, short set periods for reviewing and documenting the need for further retention, staff awareness, access restrictions within the authority, separate storage and processing, pseudonymisation where it does not defeat the purpose, encryption, and procedural rules for transfer or other-purpose processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.