Article 20 with Articles 22 and 23 and Decree Articles 25 and 33: prior authorisation is required for processing of genetic data and health research, data on offences, convictions or security measures, interconnection of files, a national identification number or other general identifier, biometric data, and processing for reasons of public interest such as historical, statistical or scientific purposes; the CDP decides within two months of receipt (extendable once by reasoned decision) and silence beyond that period counts as approval. Health research files must include the research protocol, prior ethics or scientific opinions, the persons with access and any request to derogate from coding or retention limits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.