The controller may process personal data only after obtaining the individual's consent, unless the processing is necessary to achieve a lawful purpose of the controller or of the other recipient of the data. The NCGAA Permitted Reasons guideline treats consent and the lawful-purpose necessity as the permitted reasons the controller must identify and document for each processing activity before it starts; article 19 exempts public-interest tasks, legal obligations and court orders, vital interests, public-interest scientific research and official criminal investigations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.