Sensitive personal data may be processed only on the data subject's consent; where necessary for the controller's or processor's obligations or the data subject's specific rights under relevant laws; where necessary to protect the vital interests of the data subject or another person; where necessary for preventive or occupational medicine or public health, including protection against serious cross-border threats to health or quality and safety of health care, medicinal products or devices; or where necessary for archiving in the public interest or scientific, historical research or statistical purposes. Processing sensitive data contrary to the Law is the gravest offence (article 60).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.