Processing genetic, biometric and health data is prohibited without written, withdrawable consent unless an exception applies (employment law, national security, public health, substantial public interest by law, vital interests, preventing imminent danger or a specific offence, data made public, legal rights, scientific research, or preventive medicine, diagnosis and care under a health professional). Health data are processed under a health professional's responsibility and professional secrecy, collected from others only where the subject cannot provide them, and linked to a unique patient identifier; linking that identifier with other identifiers needs express authorisation from the Authority. Children's data follow section 26.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.