Articles 88 to 90: non-personal data derived from personal health data may be treated as highly sensitive under the Data Governance Act where re-identification risk exists; digital health authorities, access bodies, infrastructure participants and users take technical, legal, organisational and contractual measures against transfers or governmental access that conflict with Union or national law, honour foreign orders only under an international agreement or the Article 89(3) safeguards, give the minimum data, and inform the holder first save for law-enforcement confidentiality; personal data transfers follow GDPR Chapter V with any added national conditions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.