Articles 1(2), 7 to 11, 13, 18, 22, 25, 27, 32, 35, 39, 48, 51, 55(3), 56 and 66 to 71: processing by competent authorities for preventing, investigating, detecting and prosecuting crimes or executing criminal sanctions, including protection against threats to public and national security, is lawful only where necessary and set by a law stating objectives, data and purposes; they distinguish categories of persons (suspects, convicted persons, victims, witnesses) and fact-based from assessment-based data, do not transmit inaccurate data, keep logs of collection, alteration, consultation, disclosure, combination and erasure in automated systems, always appoint a DPO, seek the Commissioner's opinion before creating new filing systems with high risk, and transfer abroad only under specific conditions; data subject rights may be exercised indirectly through the Commissioner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.