Data ProtectionU.K.
41.—(1) Any personal data obtained by relevant persons for the purposes of these Regulations may only be processed for the purposes of preventing money laundering or terrorist financing.
(2) Processing personal data for the purposes of preventing money laundering or terrorist financing is to be considered to be necessary for the exercise of—
(a)a function of a public nature in the public interest for the purposes of paragraph 5(d) of Schedule 2 to the Data Protection Act 1998 (conditions relevant for processing personal data) M1; and
(b)a function conferred by or under an enactment for the purposes of paragraph 7(1)(b) of Schedule 3 to the Data Protection Act 1998 (conditions relevant for processing sensitive personal data) M2.
(3) No other use may be made of personal data referred to in paragraph (1), unless—
(a)use of the data is permitted by or under an enactment other than these Regulations; or
(b)the relevant person has obtained the consent of the data subject to the proposed use of the data.
(4) Relevant persons must provide new customers with the following information before establishing a business relationship or entering into an occasional transaction with the customer—
(a)the information specified in paragraph 2(3) in Part 2 of Schedule 1 to the Data Protection Act 1998 (interpretation of data protection principles);
(b)a statement that any personal data received from the customer will be processed only for the purposes of preventing money laundering or terrorist financing, or as permitted under paragraph (3).
(5) For the purposes of this regulation, “personal data”, “processing” and “data subject” have the meanings given in section 1 of the Data Protection Act 1998 (basic interpretative provisions).
Marginal Citations
M1Paragraph 5 of Schedule 2 was amended by paragraph 4 of Schedule 6 to the Freedom of Information Act 2000.
M2Paragraph 7 of Schedule 5 was amended by paragraph 5 of Schedule 6 to the Freedom of Information Act 2000 and S.I. 2003/1887.