Processing workers' biometric data is legitimate only for attendance control and control of access to the employer's premises, using only representations (templates) of the biometric data, with a collection process that does not allow the data to be reversed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.