Communicating personal data to third parties requires the express consent of the data subject (or heirs or guardian) given by means leaving a written trace, except where needed by public authorities for public security, national defence, criminal prosecution or their legal missions. If the person refuses, the INPDP may authorise communication for vital interests, historical or scientific research or performance of a contract with the person, on a request filed within one month of the refusal, provided the recipient commits to safeguards and purpose limits; a recipient breaching the INPDP's safeguards is fined 10,000 dinars.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.