Section 73: General principles for transfers of personal data, Data Protection Act 2018

This section applies in relation to a transfer of personal data to a third country or international organisation for a law enforcement purpose.

The controller in relation to the transfer must secure that the transfer takes place only if—

the three conditions set out in subsections (2) to (4) are met, ...

in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State ..., that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State , and—

the transfer is carried out in accordance with the other provisions of this Part.

Condition 1 is that the transfer is necessary for any of the law enforcement purposes.

Condition 2 is that the transfer—

is approved by regulations under section 74AA that are in force at the time of the transfer,

is made subject to appropriate safeguards (see section 75), or

is based on special circumstances (see section 76).

Condition 3 is that—

the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation,

the intended recipient is a person in a third country who—

is not a person described in paragraph (a), but

is a processor whose processing, on behalf of the controller, of the personal data transferred is governed by, or authorised in accordance with, a contract with the controller that complies with section 59, or

in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21, 24 to 28, 34 to 51, 54 and 56 of Schedule 7—

the intended recipient is a person in a third country who is not a person described in paragraph (a) or (aa), and

the additional conditions in section 77 are met.

Authorisation is not required as mentioned in subsection (1)(b) if—

the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom, and

the authorisation cannot be obtained in good time.

Where a transfer is made without the authorisation mentioned in subsection (1)(b), the authority in the member State which would have been responsible for deciding whether to authorise the transfer must be informed without delay.

In this section, "relevant international organisation" means an international organisation that carries out functions for any of the law enforcement purposes.

Section 73: General principles for transfers of personal data

Discussed in

About this text