The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014

Transmission to private parties

41.—(1) A UK competent authority may transmit to a private party personal data received from or made available to it by a non-UK competent authority only if—

(a) the authority from which the data were obtained has consented in compliance with the applicable national law to its transmission;

(b) no legitimate specific interests of the data subject prevent transmission; and

(c) in the particular case, transmission by the UK competent authority is essential for—

(i) performance of a task lawfully assigned to it;

(ii) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

(iii) prevention of an immediate and serious threat to public security; or

(iv) prevention of serious harm to the rights of individuals.

(2) The UK competent authority transmitting the data to a private party shall inform the private party of the purposes for which the data may exclusively be used.

(3) In this regulation, “private party” does not include a body which exercises functions of a public nature, whether under contract or otherwise, when engaging in an activity that involves the exercise of those functions.