Except as another written law provides, personal information controlled by a public body may be disclosed only for the purpose for which it was collected or compiled or a use consistent with that purpose (a reasonable and direct connection necessary for statutory duties or an authorised programme, s.39), or for any purpose a written law or an order under it authorises. These two paragraphs were proclaimed with effect from 23 August 2021, the rest of Part III remaining unproclaimed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.