Article 71: natural persons may opt out at any time, without reasons and reversibly, from secondary use of their personal electronic health data; Member States provide an accessible, understandable mechanism; once exercised, identifiable data of that person are excluded from permits and requests approved afterwards (earlier permits are unaffected); Member States may by law allow public-sector public-health bodies to use opted-out data for public health, policy, statistics or important public-interest research where no timely alternative exists, with safeguards, notified to the Commission; holders need not re-identify people just to apply the opt-out. Supervisory authorities enforce the opt-out with GDPR fines (Article 65).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.