The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014

Transfer to competent authorities in third countries or to international bodies

40.—(1) Personal data transmitted or made available to a UK competent authority by a non-UK competent authority may be transferred to a third country or an international body only if—

(a) it is necessary for the prevention, investigation, detection or prosecution of a criminal offence or the execution of a criminal penalty;

(b) the receiving authority in the recipient third country or receiving international body is responsible for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

(c) subject to paragraph (2), the competent authority from which the data were obtained has given its prior consent to the transfer in compliance with the applicable national law; and

(d) subject to paragraph (3), the third country or international body concerned ensures an adequate level of protection for the intended data processing.

(2) Transfer without prior consent is permitted only if—

(a) transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country or to essential interests of a Member State; and

(b) such consent cannot be obtained in good time.

(3) Where a transfer is made without prior consent, the authority otherwise responsible for giving it must be informed without delay.

(4) Paragraph (1)(d) does not apply where—

(a) the transfer is necessary to pursue—

(i) the legitimate specific interests of the data subject; or

(ii) other legitimate prevailing interests, especially important public interests; or

(b) the third country or receiving international body provides safeguards which are deemed adequate by the person or body that intends to make the transfer.

(5) The adequacy of the level of protection referred to in paragraph (1)(d) shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations including, in particular—

(a) the nature of the data;

(b) the purpose and duration of the proposed processing operation or operations;

(c) the State of origin and the State or international body of final destination of the data;

(d) the rules of law in force in the third country or which apply to the international body in question; and

(e) the professional rules and security measures which apply.

(6) In this regulation, “third country” means a State other than a Member State.