Where special category data are processed under Article 9(2)(b), (h), (i) or (j) of the UK GDPR the controller must meet a condition in Schedule 1 Part 1: employment, social security and social protection obligations (with an appropriate policy document), health or social care purposes (by or under a health or social work professional or someone owing confidentiality), public health under a health professional, or archiving, research and statistics under Article 84B in the public interest. Substantial public interest processing under Article 9(2)(g) must meet a Part 2 condition, almost all needing an appropriate policy document: statutory and government purposes, justice and Parliament, equality of opportunity monitoring (subject to a written objection by the data subject), racial and ethnic diversity at senior levels, preventing or detecting unlawful acts, protecting the public against dishonesty, regulatory requirements, journalism about wrongdoing, preventing fraud through anti-fraud organisations, money laundering and terrorist financing disclosures, disability and medical condition support bodies, confidential counselling, safeguarding children and adults at risk, economic well-being, insurance, occupational pensions, political parties, elected representatives and disclosures to them, informing representatives about prisoners, publishing judgments, anti-doping and standards of behaviour in sport. Criminal offence data outside official authority must meet a condition in Part 1, 2 or 3; Part 3 adds consent, vital interests, not-for-profit members, data made public, legal claims, judicial acts, payment card accounts used in child indecency offences, and the Part 2 conditions without the substantial public interest test.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.