Without transfer regulations or Article 46 safeguards, a transfer may take place only on explicit consent after being told of the risks, necessity for a contract with or in the interest of the data subject, important reasons of public interest recognised in domestic law (regulations may specify when a transfer is or is not necessary for that), legal claims, vital interests where consent is impossible, or transfer from a public register within its consultation conditions. Failing all these, a transfer may be made only if it is not repetitive, concerns a limited number of people, is necessary for compelling legitimate interests not overridden by the data subjects' rights, and the controller has assessed the circumstances and provided suitable safeguards, informing the Commissioner and the data subjects; the assessment is documented in the Article 30 records. Consent, contract and compelling-interest derogations are not available to public authorities exercising public powers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.