Public authorities, local authorities and administrative public establishments (for security, defence, prosecution or their legal missions), public health establishments and public establishments exercising public powers are exempt from several rules (declaration, authorisation, consent, and for the first group sensitive data and objection) and access to their data cannot be exercised; but they must correct, complete, update or delete data a data subject reports in writing as inaccurate, may not communicate data to private persons without the data subject's express written consent, must on dissolution or merger have the supervising authority protect or destroy the data by administrative report, and must destroy data when the legal retention period ends or the purpose is achieved, with an administrative report. The second group's data subjects may request correction and object where the law is breached, with disputes to the INPDP within one month.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.