Article 9: to avoid discrimination, the data subject's consent alone does not lift the prohibition on processing whose main purpose is identifying ideology, trade union membership, religion, sexual orientation, beliefs or racial or ethnic origin (other GDPR 9.2 grounds remain available); processing under GDPR 9.2.g, h and i based on Spanish law needs a norm with the rank of law, which may cover health and social care management and insurance contracts. Additional provision 17 lists the statutes that qualify for health and genetic data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.