Without transfer regulations or appropriate safeguards, a transfer may be made only where necessary to protect vital interests, safeguard the data subject's legitimate interests, prevent an immediate and serious threat to public or national security, or in particular circumstances for a law enforcement or legal purpose (the last two not where the data subject's rights override the public interest); the amount of data must not be excessive for the purpose; and each transfer must be documented with date and time, recipient, justification and data description, given to the Commissioner on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.