Anonymised data are not personal data unless the anonymisation can be reversed using the controller's own means or, with reasonable effort, judged on objective factors such as the cost and time needed with the technology available; data used to build the behavioural profile of an identified person may also count as personal data. Research bodies carrying out public health studies may access personal databases only within the body and strictly for the study, kept in a controlled and secure environment under the security practices of specific regulation, with anonymisation or pseudonymisation wherever possible and due ethical standards; published results may never reveal personal data; the research body is responsible for information security and may not transfer the data to third parties. Pseudonymisation means processing after which data can no longer be associated with an individual except by additional information kept separately by the controller in a controlled and secure environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.