The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014

Scope

28.—(1) Subject to paragraph (3), this Part applies in relation to the processing of personal data by a UK competent authority which is carried out—

(a) for the purposes of the prevention, investigation, detection or prosecution of a criminal offence or the execution of a criminal penalty;

(b) in the circumstances set out in paragraph (2); and

(c) in the course of activities within the scope of a relevant EU measure.

(2) The circumstances are that the processing of personal data is or has been transmitted or made available—

(a) between Member States;

(b) to an authority or information system established on the basis of Title VI of the Treaty on European Union (as it had effect before 1st December 2009) or Chapter 1, 4 or 5 of Title V of Part Three of the Treaty on the Functioning of the European Union; or

(c) to a UK competent authority by an authority or information system established on the basis of Title VI of the Treaty on European Union (as it had effect before 1st December 2009) or Chapter 1, 4 or 5 of Title V of Part Three of the Treaty on the Functioning of the European Union.

(3) This Part does not apply to the processing of personal data transmitted to or made available to a UK competent authority that is subject to the Data Protection Framework Decision if those data originated in the United Kingdom.

(4) In this regulation, a relevant EU measure is—

(a) any measure adopted under Chapter 4 (judicial cooperation in criminal matters) or Chapter 5 (police cooperation) of Title V of Part Three of the Treaty on the Functioning of the European Union which binds the United Kingdom;

(b) any act of the Union in the field of police cooperation and judicial cooperation in criminal matters adopted on the basis of Title V or VI of the Treaty on European Union prior to the entry into force of the Treaty of Lisbon in which the UK participates by virtue of Title VII of Protocol 36 (transitional provisions) to the EU Treaties.