A controller may restrict GDPR Article 23 rights only where the restriction is a necessary measure for national or public security, defence or international relations; prevention, detection, investigation and prosecution of crime including anti-money laundering; administration of tax, duties, fines and other State revenue; social security fraud investigations using data obtained in confidence; establishing, exercising or defending legal claims; the Commissioner's functions; social work services using data obtained in confidence; health data where the rights would seriously harm the patient's vital interests; or refused citizenship applications. Every restriction must respect the essence of fundamental rights and be necessary and proportionate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.