Article 33 with Decree Article 32: processing is legitimate if the data subject consents (consent being an express, unequivocal, free, specific and informed expression of will, Article 4(4)); without consent it is allowed only where necessary to comply with a legal obligation, to perform a task in the public interest or of public authority, to perform a contract with the data subject or pre-contractual steps at their request, or to safeguard the data subject's interests or fundamental rights and freedoms. There is no legitimate-interests basis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.