Transfer of personal data to countries not providing adequate protection levels is prohibited, except: subject authorization; medical/health exchange; bank/stock transfers; treaties; legal/judicial cooperation; or SIC-declared adequacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.