Processing and disclosure are unlawful without the data subject's free, express and informed consent, in writing or an equivalent means, set out expressly and prominently when given with other statements, after the notice of 5.3; investigation and intelligence bodies are exempt with judicial authorisation. Before requesting a credit report, financial intermediaries, economic agents and other SIC subscribers must obtain the data subject's express written consent to be consulted, keep it for six months from signature, and keep the reports strictly confidential, bearing sole liability for any breach. Article 27 lists when consent is not needed: public-access sources; state functions or a legal obligation; marketing lists limited to name, identity card, passport, tax number and biographical data; data needed for a commercial, employment, contractual, scientific or professional relationship; client data of regulated financial intermediaries, economic agents, SICs and credit-scoring entities under these conditions; where a law so provides; transfers between state bodies within their powers; health data needed for public health, emergencies or epidemiology with dissociation; and dissociated data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.