The Controller discloses data only with consent, from a publicly available source, at a Public Entity's request for public interest, security, legal or judicial needs, to protect public health, safety or specific lives or health, where the recipient's processing will not identify anyone, or for its legitimate interest without sensitive data (Law 15); and never under the consent, public-source, de-identified or legitimate-interest grounds if the disclosure threatens security or the Kingdom's reputation or interests, affects foreign relations, hinders crime detection or fair trial, endangers an individual, violates another person's privacy, conflicts with the interests of someone lacking capacity, breaches professional obligations or judicial decisions, or exposes a confidential source (Law 16). Disclosures are tied to a clear purpose, protect privacy and are minimised; public-source disclosures confirm the source was lawful; authority requests are documented with the data identified; third-party data in a disclosure is balanced and pseudonymised where possible; legitimate-interest disclosures follow IR 16; and all disclosures are recorded with dates, methods and purposes (IR 20). Public Entities processing for public interest follow IR 21.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.