A public body may transfer personal data to another public body where necessary for either's tasks and the Article 24 conditions are met, and the recipient uses them only for the transfer purpose; to a private body only where necessary for its tasks under Article 24, where the recipient has a legitimate interest and the data subject has no legitimate interest against it, or where needed for legal claims and the recipient undertakes to use the data only for that purpose; special categories need an Article 9(2) GDPR or Article 22 exemption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.