Further processing of personal data collected from a party other than the data subject is allowed only where expressly authorised by law with adequate safeguards; in the private sector where the data subject consents to the sharing (required even for sharing with an affiliate or parent company), commercial sharing including direct marketing is covered by a data sharing agreement that establishes safeguards and upholds data subjects' rights and is subject to the Commission's review, and the data subject is told before collection or sharing the identity of the recipients, the purpose, the categories of data, the intended recipients, the existence of their rights including access, correction and objection, and the nature and extent of the sharing; for research where the data is publicly available or consented with safeguards and no decision affecting the data subject; and between government agencies for a public function under a data sharing agreement subject to the Commission's review (NPC Circular 16-02 for government).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.