Where processing of personal or special category data is necessary for a task carried out in the public interest (GDPR arts 6(1)(e) and 9(2)(g)), the controller or third party must put in place: (a) appropriate technical and organisational measures to respect the GDPR art. 5 principles, in particular data minimisation and integrity and confidentiality; (b) a data protection officer where required under art. 10; and (c) storage periods by nature of the data and purpose, with specific deadlines for erasure or review for erasure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.