A controller or processor processing for scientific or historical research or official statistics may derogate from the rights of access, rectification, restriction and objection (GDPR Articles 15, 16, 18, 21), and for archiving in the public interest also from notification and portability (Articles 19 and 20), only where exercising the right is likely to render impossible or seriously impair the purpose and the controller reasonably believes the derogation necessary. The derogation covers only that purpose where processing serves another purpose too, and the processing must carry appropriate safeguards including pseudonymisation and data minimisation measures, using non-identifying data wherever the purpose allows.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.