A controller answering an access request need not disclose information relating to another identifiable individual (including as the source) unless that person consents or it is reasonable to disclose without consent, judged on the type of information, any duty of confidentiality, steps taken to seek consent, capacity to consent and any express refusal; identifiability takes account of other information the requester is likely to have. Disclosure without consent is treated as reasonable where the other person is a health professional who compiled or contributed to a health record, or a social work or education worker acting in an official capacity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.