Personal data may not be processed without the data subject's explicit consent, unless one condition applies: it is expressly provided for by law; it is necessary to protect the life or bodily integrity of a person unable to express consent through physical impossibility or whose consent is not legally valid; processing the data of contracting parties is necessary and directly related to establishing or performing a contract; it is necessary for the controller's legal obligation; the data subject has made the data public; it is necessary to establish, exercise or protect a right; or it is necessary for the controller's legitimate interests without harming the data subject's fundamental rights and freedoms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.