Personal data may be communicated between public institutions only where the source obtained them in exercising its legal functions, the recipient needs them for its legal functions within its powers, the data are adequate, proportionate and not excessive for that purpose, and for sensitive data the data subject consented or an Article 20 exception applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.