For sensitive personal data the controller must obtain the data subject's express written consent by autograph signature, electronic signature or another authentication mechanism established for that purpose. Databases containing sensitive data may not be created unless justified for legitimate, specific purposes consistent with the explicit activities or aims of the regulated person.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.