Sensitive data (GDPR Article 9(1)) may be processed under Article 9(2)(b) where necessary for the controller or data subject to meet obligations and exercise specific rights in employment law, social security and social protection; such data may be passed to third parties only where there is an obligation to do so in those fields or the data subject has explicitly consented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.