Legislation – Data Protection Act 2018

the three conditions set out in subsections (2) to (4) are met, F3…

in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State F4…, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State F5, and—

the transfer is carried out in accordance with the other provisions of this Part.

is approved by regulations under section 74AA that are in force at the time of the transfer,

is made subject to appropriate safeguards (see section 75), or

is based on special circumstances (see section 76).

the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

the transfer is necessary for the prevention of an immediate and serious threat F9to the public security, national security or essential interests of a third country or the United Kingdom, and

the authorisation cannot be obtained in good time.

a third country, or

an international organisation.

make provision by reference to a third country or international organisation specified in the regulations or a description of country or organisation;

approve all transfers of personal data to a third country or international organisation or only transfers specified or described in the regulations;

confer a discretion on a person.

this Part, and

Parts 5 to 7, so far as relevant to law enforcement processing.

respect for the rule of law and for human rights in the country or by the organisation,

the existence, and powers, of an authority responsible for enforcing the protection of data subjects with regard to the processing of personal data in the country or by the organisation,

arrangements for judicial or non-judicial redress for data subjects in connection with such processing,

rules about the transfer of personal data from the country or by the organisation to other countries or international organisations,

relevant international obligations of the country or organisation, and

the constitution, traditions and culture of the country or organisation.

the references to the protection provided for data subjects are to that protection taken as a whole,

the references to law enforcement processing are to processing by a competent authority for any of the law enforcement purposes or equivalent types of processing in the third country or by the international organisation (as appropriate), and

the references to processing of personal data in the third country or by the international organisation are references only to the processing of personal data transferred to the country or organisation by means of processing to which this Act applies as described in section 207(2).

the references in subsections (1) to (3) to personal data are to be read as references only to personal data likely to be the subject of such transfers, and

the reference in subsection (2)(d) to transfer to other countries or international organisations is to be read as including transfer within the third country or international organisation.

a list of the third countries F20… and international organisations, and the descriptions of such countries F21… and organisations, which are for the time being F22approved by regulations under section 74AA as places or persons to which personal data may be transferred, and

a list of the third countries F23… and international organisations, and the descriptions of such countries F24… and organisations, which have been but are no longer F25approved by such regulations.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

the lists published under subsection (6) must specify or describe the relevant transfers.

an appropriate legal instrument binds the intended recipient of the data (see subsection (4)), or

the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (see subsection (5)).

the transfer must be documented,

the documentation must be provided to the Commissioner on request, and

the instrument is intended to be relied on in connection with the transfer or that type of transfer,

at least one competent authority is a party to the instrument, and

each competent authority that is a party to the instrument, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (see subsection (5)).

this Part, and

Parts 5 to 7, so far as they relate to processing by a competent authority for any of the law enforcement purposes.

it is made in the absence of approval by regulations under section 74AA and of compliance with section 75 (appropriate safeguards), and

it is necessary for a special purpose.

to protect the vital interests of the data subject or another person,

to safeguard the legitimate interests of the data subject,

for the prevention of an immediate and serious threat to the public security F39or national security of F40… a third country F41or the United Kingdom,

F42in particular circumstances, for any of the law enforcement purposes, or

F43in particular circumstances, for a legal purpose.

the transfer must be documented,

the documentation must be provided to the Commissioner on request, and

it is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings) relating to any of the law enforcement purposes,

it is necessary for the purpose of obtaining legal advice in relation to any of the law enforcement purposes, or

it is otherwise necessary for the purposes of establishing, exercising or defending legal rights in relation to any of the law enforcement purposes.