Articles 40 and 41: collection and processing revealing racial, ethnic or regional origin, parentage, political opinions, religious or philosophical beliefs, trade-union membership, sex life, genetic data or health is prohibited, except where the data were manifestly made public by the person, the person gave written consent, it is needed for vital interests when the person cannot consent, for legal claims (genetic data only to prove a genetic link, identify a person or prevent or punish a specific offence), a judicial procedure or criminal investigation is open, it serves a public interest such as historical, statistical or scientific purposes, it is needed for a contract or pre-contractual steps, for a legal obligation, for a public-interest task or by a public authority, or within the legitimate activities of a non-profit body limited to its members and not disclosed without consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.