Without adequacy, a transfer to a foreign competent authority may take place where appropriate safeguards are provided by law or binding sub-legal act, or where the controller has assessed all the circumstances and concludes that appropriate safeguards exist, informing the Commissioner of the categories of such transfers. Failing both, a transfer is allowed only where necessary to protect vital interests, to safeguard the data subject's legitimate interests where law provides, to prevent an immediate and serious threat to public security of Albania or a third country, in individual cases for law enforcement purposes where safeguards cannot be applied in time, or in individual cases for legal claims; not where the data subject's rights override the public interest in the last two cases.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.