A responsible party may not process personal information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour (alleged offences and related proceedings) unless the data subject consents, processing is necessary to establish, exercise or defend a right or obligation in law, it complies with an obligation of international public law, it is for historical, statistical or research purposes in the public interest or where consent is impossible or disproportionate with sufficient guarantees, the information was deliberately made public by the data subject, or the specific authorisations of sections 28 to 33 apply (religious bodies and their members; race or ethnicity for identification or affirmative-action purposes under law; trade unions and their members; political parties and their members; health and sex-life data by medical professionals, insurers, schools, employers under employment law and public bodies, subject to confidentiality; criminal behaviour and biometrics by bodies charged with applying criminal law or under law); the Regulator may authorise other processing in the public interest with safeguards. Transfer of special personal information to a foreign country without adequate protection requires prior authorisation (57).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.