Consent is not required where personal data are collected or transferred for the functions of public entities within their competences; for data in publicly accessible sources; for data on financial solvency and credit according to law; under a competition-promotion rule of a regulator for regulated markets provided the information is not used to the user's prejudice; where data are necessary for the preparation, conclusion and performance of a contractual relationship to which the data subject is party, or derive from a scientific or professional relationship and are necessary for it; for health data necessary in a risk situation for prevention, diagnosis and medical or surgical treatment in health establishments or by health professionals under professional secrecy, or for public-interest or public-health reasons qualified by the Ministry of Health, or for epidemiological studies under adequate dissociation; for non-profit political, religious or trade-union bodies about their own members, not transferable without consent; where an anonymisation or dissociation procedure has been applied; where processing is necessary to safeguard the data subject's legitimate interests; for anti-money-laundering and terrorist-financing prevention or other legal mandates; within economic groups of reporting entities sharing client information for those purposes with confidentiality safeguards; in the constitutionally valid exercise of freedom of information; and other cases deriving from competences expressly established by law. The Reglamento (articles 11 to 17) details each case.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.