A responsible party may not process personal information concerning a child (a person under 18 not legally competent to act without a competent person) unless a competent person gives prior consent, processing is necessary to establish, exercise or defend a right or obligation in law, it complies with an obligation of international public law, it is for historical, statistical or research purposes in the public interest or where consent is impossible or disproportionate with sufficient guarantees, or the information was deliberately made public by the child with a competent person's consent; the Regulator may authorise other processing in the public interest subject to conditions on parental access, correction, withdrawal and marketing. Transfer of children's information to a foreign country without adequate protection requires prior authorisation (57).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.