Unless a specific law provides otherwise, prior authorisation of the CNDP is required for processing sensitive data (except by religious, philosophical, political, trade union, cultural or sports non-profit bodies for data matching their object, about members and regular contacts and not communicated to third parties without express consent), use of data for purposes other than those for which it was collected, genetic data (except by health personnel for preventive medicine, diagnosis or care), data on offences, convictions or security measures (except by officers of justice), data including the national identity card number, and interconnection of files of public service bodies with different public interest purposes or of other legal persons with different main purposes. Applications state the controller or representative, purposes and characteristics, interconnections, data, source and data subjects, retention, services and persons with access, recipients, the office for access rights, security measures, use of a processor and transfers abroad; the CNDP decides within two months, extendable once, and silence means authorisation; changes require a new application and deletion must be notified (Decree Articles 27 and 28).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.