Absent an adequacy decision, a transfer may occur only where: (a) the data subject explicitly consented after being informed of the possible risks; (b) it is necessary for a contract with the data subject or pre-contract measures at their request; (c) it is necessary for a contract concluded in the data subject's interest with another person; (d) it is necessary for important reasons of public interest; (e) it is necessary for legal claims; or (f) it is necessary to protect vital interests where the data subject is physically or legally incapable of consenting. In every case the data subject must have been clearly warned of the specific principles likely to be violated by the transfer, except where the data subject is answerable in legal action for a civil or criminal claim in the third country.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.