Processing sensitive personal information and privileged information is prohibited except where the data subject has given consent specific to the purpose before processing (for privileged information, all parties to the exchange); where existing law or regulation provides for it and guarantees protection and does not require consent; where necessary to protect the life and health of the data subject or another person who cannot consent beforehand; where necessary for the lawful, non-commercial objectives of public organisations and their associations, confined to bona fide members, not transferred to third parties and with prior consent; where necessary for medical treatment by a practitioner or institution with an adequate level of protection; or where necessary to protect lawful rights and interests in court proceedings, for legal claims, or when provided to government or a public authority.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.