Data Protection Act 2018

73 General principles for transfers of personal data U.K.

(1) A controller may not transfer personal data to a third country or to an international organisation unless—

(a) the three conditions set out in subsections (2) to (4) are met, and

(b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State F1 ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

(2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

(3) Condition 2 is that the transfer—

(a) is based on [F2 adequacy regulations (see section 74A)],

(b) if not based on [F3 adequacy regulations], is based on there being appropriate safeguards (see section 75), or

(c) if not based on [F4 adequacy regulations] or on there being appropriate safeguards, is based on special circumstances (see section 76).

(4) Condition 3 is that—

(a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or

(b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

(i) the intended recipient is a person in a third country other than a relevant authority, and

(ii) the additional conditions in section 77 are met.

(5) Authorisation is not required as mentioned in subsection (1)(b) if—

(a) the transfer is necessary for the prevention of an immediate and serious threat either to the public security of F5 ... a third country or to the essential interests of a member State, and

(b) the authorisation cannot be obtained in good time.

(6) Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

(7) In this section, “relevant international organisation” means an international organisation that carries out functions for any of the law enforcement purposes.

Textual Amendments

F1 Words in s. 73(1)(b) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(2) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F2 Words in s. 73(3)(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(3)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in s. 73(3)(b) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F4 Words in s. 73(3)(c) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(3)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

F5 Words in s. 73(5)(a) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 40(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)