Personal data may be collected without consent only where: (1) it serves historical documents or archives in the public interest, or research or statistics, with suitable safeguards for the data subject's rights and freedoms as the Committee prescribes; (2) it prevents or suppresses a danger to a person's life, body or health; (3) it is necessary to perform a contract with the data subject or to take steps at their request before a contract; (4) it is necessary for a task in the public interest or for official authority vested in the controller; (5) it is necessary for the legitimate interests of the controller or another person, unless overridden by the data subject's fundamental rights; or (6) it is necessary to comply with a law that binds the controller.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.