A competent authority may transfer personal data to a third country or international organisation, including onward, only where the recipient is a competent authority, the transfer is needed for an Article 47 purpose, and the conditions of Articles 70 to 73 are met, without lowering protection. Onward transfers need the prior authorisation of the authority that made the first transfer, weighing the seriousness of the offence, the original purpose and the protection at the new destination. Transfers under Articles 72 or 73 must be documented (date and time, receiving authority, justification, data transferred) and the documentation made available to the Commissioner. Transfers to destinations the Commissioner has found adequate need no specific authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.