Without adequacy or safeguards, a transfer may take place only on explicit consent after being informed of the risks, for a contract with or in the interest of the data subject, important public interest recognised by law, legal claims, vital interests where consent is impossible, or from a public register within its consultation conditions (never the whole register). Failing these, a transfer is permitted only if it is not repetitive, concerns a limited number of data subjects, is necessary for compelling legitimate interests not overridden by the data subject's rights, and the controller has assessed all circumstances and provided suitable safeguards; the controller must inform the Agency and the data subject of the transfer and the compelling interests, and document the assessment and safeguards in its Article 31 records. Consent, contract and compelling interest derogations are not available to public authorities exercising their powers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.