Listed data is exempt, including HIPAA protected health information and health records, human subjects research data, patient safety and quality data, consumer report activity regulated by the FCRA, data handled under the Driver's Privacy Protection Act, FERPA and the Farm Credit Act, and employment-context data (applicants, employees, contractors, emergency contacts and benefits administration). Businesses complying with COPPA verifiable parental consent are treated as meeting the Act's parental consent obligations (subsection D).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.