(1)If it appears to the Registrar that—
(a)a person registered as a data user or as a data user who also carries on a computer bureau ; or
(b)a person treated as so registered by virtue of section 7(6) above,
proposes to transfer personal data held by him to a place outside the United Kingdom, the Registrar may, if satisfied as to the matters mentioned in subsection (2) or (3) below, serve that person with a notice (" a transfer prohibition notice ") prohibiting him from transferring the data either absolutely or until he has taken such steps as are specified in the notice for protecting the interests of the data subjects in question.
(2)Where the place to which the data are to be transferred is not in a State bound by the European Convention the Registrar must be satisfied that the transfer is likely to contravene, or lead to a contravention of, any of the data protection principles.
(3)Where the place to which the data are to be transferred is in a State bound by the European Convention the Registrar must be satisfied either—
(a)that—
(i)the person in question intends to give instructions for the further transfer of the data to a place which is not in such a State ; and
(ii)that the further transfer is likely to contravene, or lead to a contravention of, any of the data protection principles; or
(b)in the case of data to which an order under section 2(3) above applies, that the transfer is likely to contravene or lead to a contravention of, any of the data protection principles as they have effect in relation to such data.
(4)In deciding whether to serve a transfer prohibition notice the Registrar shall consider whether the notice is required for preventing damage or distress to any person and shall have regard to the general desirability of facilitating the free transfer of data between the United Kingdom and other states and territories.
(5)A transfer prohibition notice shall specify the time when it is to take effect and contain—
(a)a statement of the principle or principles which the Registrar is satisfied are likely to be contravened and his reasons for reaching that conclusion ; and
(b)particulars of the rights of appeal conferred by section 13 below.
(6)Subject to subsection (7) below, the time specified in a transfer prohibition notice pursuant to subsection (5) above shall not be before the end of the period within which an appeal can be brought against the notice and, if such an appeal is brought, the notice shall not take effect pending the determination or withdrawal of the appeal.
(7)If by reason of special circumstances the Registrar considers that the prohibition should take effect as a matter of urgency he may include a statement to that effect in the transfer prohibition notice; and in that event subsection (6) above shall not apply but the notice shall not take effect before the end of the period of seven days beginning with the date on which the notice is served.
(8)The Registrar may cancel a transfer prohibition notice by written notification to the person on whom it was served.
(9)No transfer prohibition notice shall prohibit the transfer of any data where the transfer of the information constituting the data is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the United Kingdom.
(10)Any person who contravenes a transfer prohibition notice shall be guilty of an offence; but it shall be a defence for a person charged with an offence under this subsection to prove that he exercised all due diligence to avoid a contravention of the notice in question.
(11)For the purposes of this section a place shall be treated as in a State bound by the European Convention if it is in any territory in respect of which the State is bound.