Data covered by GDPR Article 10 may be processed by authorities, and by others where needed to follow archive rules; under the Ordinance, non-authorities may also process it where needed to establish, exercise or defend legal claims or to meet a legal obligation under an Act or ordinance, and IMY may issue further regulations or grant individual permission. Breaches of Article 10 can attract an administrative fine (Act 6:3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.