A public body may not provide personal information unless it was lawfully published or made available for public review, or the data subject consented; exceptions for provision between public bodies and to government ministries apply where not prohibited by law or professional ethics and necessary for a statutory purpose (23C); unlawful provision for unauthorised processing is an offence (23NG).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.