Article 28-9: the Commission may order a controller to stop an ongoing or expected transfer where it breaches Article 28-8 or the recipient or destination fails to protect the information adequately so that harm occurs or is highly likely; the controller may object within seven days; the Commission may apply reciprocal restrictions to controllers of countries that restrict transfers (Article 28-10). Failing to comply with a suspension order attracts a penalty surcharge.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.