Articles 17 to 19: provision (including sharing) to a third party requires the data subject's consent after being told the recipient, its purpose, the items, its retention period and the right to refuse, or must fall within the purpose of collection under the legal-duty, public-task, vital-interest, legitimate-interest or public-safety bases; related further provision is possible under decree criteria; use or provision beyond these limits is prohibited except with separate consent, special legal provision, urgent vital interests or, for public institutions only, listed public purposes (published in the Gazette or online); recipients may use the information only for the purpose received unless the data subject separately consents or a law provides.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.