Article 15(1) and 16: collection and use within the purpose are allowed with the data subject's consent; where a law specially provides or it is unavoidable to meet a legal duty; where a public institution needs it for duties under law; to perform or conclude a contract at the data subject's request; where clearly necessary for urgent life, bodily or property interests; for the controller's legitimate interests where these clearly override the data subject's rights, within a reasonable scope related to those interests; or where urgently needed for public safety such as public health; only the minimum needed may be collected (the controller bears the burden of proof), and people must be told they may refuse non-essential items without being refused service. Article 15(3) allows further use reasonably related to the original purpose, considering disadvantage and safeguards such as encryption, as set by decree.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.