It is an offence knowingly or recklessly to re-identify de-identified personal data without the consent of the controller responsible for de-identifying it, or to process data so re-identified; defences include crime prevention, legal requirement, public interest, reasonable belief in consent, journalism, and effectiveness testing where the person acted to test de-identification, without intent to cause damage or distress, in the public interest and notified the Commissioner or controller without undue delay and where feasible within 72 hours.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.