Where a national identification number is processed on the controller's or a third party's legitimate interest (GDPR art. 6(1)(f)), including collecting or disclosing documents containing it, the controller must put in place: (a) appropriate technical and organisational measures, in particular for data minimisation and for security and confidentiality under GDPR art. 32; (b) the appointment of a data protection officer under art. 10 of the Law; (c) storage periods set by the nature of the data and purpose, with specific deadlines for erasure or review for erasure; and (d) periodic training of persons processing personal data under the direct authority of the controller or processor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.