A mandatory code must at least bar disclosure to third parties without consent except for the collection purpose or a consistent use, a court order or written law, and require the organisation to inform the individual and obtain consent before disclosure abroad, then disclose where safeguards are comparable or refer to the Commissioner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.