Data may be transferred or communicated to third parties only to fulfil purposes directly related to the legitimate functions of controller and recipient, on one of the Act's lawful bases, and with the data subject's informed consent (knowing the purpose and the recipient's type of activity). Consent is not needed where data come from publicly accessible sources; a freely accepted legal relationship necessarily requires the communication (limited to that purpose); authorities request the data under their legal powers; public administrations share dissociated or at least anonymised data for historical, statistical or scientific purposes; or health data must be communicated for an emergency affecting the vital interests of a data subject unable to consent, or for public-interest epidemiological studies (preferably anonymised and in any case aggregated after the emergency). Consent to communication may be withdrawn at any time, and the recipient becomes bound by the Act. The Reglamento exempts communications where data were first dissociated, robustly encrypted or otherwise protected so that the persons cannot be identified, binds recipients to data protection law, and requires controllers to pass on rectification, updating, objection and deletion requests to recipients.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.