Decree Articles 37 to 39 with Law Article 35: when data collected for a defined purpose are communicated to a third party for later historical, statistical or scientific processing, they are first made anonymous or coded by the controller or a competent body; results may be published in identifiable form only with the person's express consent or where limited to data the person manifestly made public; the CDP rules on whether a use is historical, statistical or scientific (not applicable to public security, defence, criminal and State security processing).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.