An authority may process sensitive data under Article 9(2)(g) if the data was provided to it and processing is required by law, if it is needed to handle a case, or otherwise if necessary for an important public interest and not an undue intrusion into privacy; when relying only on this section, searches designed to select people on the basis of sensitive data are forbidden. Non-authorities are treated as authorities for point 1 where public-document and secrecy rules apply to them, and the government may issue further rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.