Article 21: unless authorised by law, automated processing carried out for the State, a public establishment, a local authority or a private body running a public service is decided by regulatory act after a reasoned CDP opinion when it concerns State security, defence or public security; prevention and prosecution of offences and execution of sentences; the population census; data revealing racial, ethnic or regional origin, parentage, political, philosophical or religious opinions, trade-union membership, health or sex life; or salaries, pensions, taxes and other settlements. Article 76 let existing State processing be regularised by simple declaration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.