Consent is not required where processing serves the data subject's actual interests and contacting them is impossible or difficult (the Controller keeps evidence of the interest and the difficulty, IR 14); where it is under another law or a prior agreement with the data subject; where a Public Entity processes for security or judicial requirements; or for the Controller's legitimate interest without prejudice to the data subject and with no sensitive data (Law 6). Legitimate interest is not available to Public Entities and requires a lawful purpose, a balance of interests, no sensitive data and processing within the data subject's reasonable expectations (examples include fraud detection and network and information security); before relying on it the Controller conducts and documents an assessment of the processing, its purposes, data types and data subjects, the lawfulness of the purpose, necessity, potential harm to data subjects and their rights, and mitigating measures, and modifies the processing or chooses another basis if the assessment shows harm or illegality (IR 16).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.