A controller or processor does not process, or permit a processor to process on its behalf, sensitive personal data unless the data subject has given and not withdrawn consent for the specific purpose; the processing is necessary under employment, social security or similar laws; necessary to protect vital interests where the data subject is physically or legally incapable of consenting; carried out with safeguards by a non-profit foundation, association or body with charitable, educational, literary, artistic, philosophical, religious or trade union purposes about its members or regular contacts and not disclosed outside without explicit consent; necessary for legal claims, legal advice or proceedings; necessary for substantial public interest on the basis of a proportionate law with specific safeguards; carried out for medical care or community welfare under a professional owing a duty of confidentiality; necessary for public health with specific safeguards; or necessary for archiving in the public interest or historical, statistical or scientific research on the basis of a proportionate law with safeguards. The Commission may prescribe further sensitive categories, grounds and safeguards, having regard to the risk of significant harm, the reasonable expectation of confidentiality and the adequacy of general protection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.