Article 8: processing based on a legal obligation (GDPR 6.1.c) is valid only where EU law or a norm with the rank of law provides for it, which may set conditions, data types, disclosures and extra safeguards; processing based on a public task or official authority (GDPR 6.1.e) requires a competence conferred by a norm with the rank of law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.