Data may be used for scientific, research or statistical purposes without consent only if it does not identify the data subject, if identity evidence is destroyed during processing before disclosure (not for sensitive data), or if required by law or a prior agreement (Law 27); the Controller records the purposes in the processing records, minimises data, pseudonymises where the purpose allows, and ensures no negative impact on data subjects (IR 30).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.