Processing is lawful where the data subject has given free, prior, express and informed consent, which must be documented; consent given together with other declarations must appear expressly and prominently after the article 13 information has been given; prior consent is not required where data come from public sources such as registers or mass media, are collected for the State's own functions or under a legal obligation, are limited to the listed identification data of natural persons (names, identity document, nationality, address, date of birth) or of legal persons, derive from a contractual, scientific or professional relationship with the data subject and are necessary for it, or are processed by natural persons for exclusively personal or domestic use. Decreto 414/009 requires the consent request to make the purpose and the responsible party's activity unequivocally known (otherwise void), a simple, clear and free means with two unmarked options, proof kept by the responsible party, and silence after ten working days treated as refusal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.