Article 23: information on ideology or beliefs, trade union or party membership, political views, health and sex life, and other decree-listed information seriously affecting privacy, may be processed only with consent separate from other consents (after the required notice) or where a law requires or permits it; the controller takes Article 29 safeguards against its loss, theft, leak, forgery, alteration or damage; where goods or services disclose information that could reveal sensitive information, the controller tells data subjects beforehand of that possibility and how to keep it private.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.