Personal data on medical records, medical care, genes, sex life, health examinations and criminal records may not be collected, processed or used except where a statute expressly provides; within what a government agency's statutory duty or a non-government agency's legal obligation requires, with appropriate security measures before or after; where the data subject or law has made it public; for de-identified statistics or research on medical, health or crime prevention grounds by government or academic bodies; to assist such duties or obligations with security measures; or with the data subject's written consent (not valid beyond the purpose, where other law restricts it, or against their will). Notice duties in Articles 8 and 9 apply. ER 4 defines each category, for example sex life as sexual orientation or practices and criminal records as deferred prosecution, non-prosecution or final conviction records.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.