European Union (Future Relationship) Act 2020

3 Transfers to third countries of personal data notified under section 2

(1) Personal data notified to the designated UK authority as mentioned in section 2 may not be transferred to a third country unless conditions A and B are met.

(2) Condition A is that the transfer—

(a) is based on adequacy regulations, or

(b) is based on there being appropriate safeguards.

(3) For the purposes of subsection (2)—

(a) the reference to a transfer being based on adequacy regulations has the same meaning as it has for the purposes of Part 3 of the Data Protection Act 2018;

(b) the reference to a transfer being based on there being appropriate safeguards is to be read in accordance with section 75 of that Act.

(4) Condition B is that the intended recipient has functions relating to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

(5) See also section 73 of the Data Protection Act 2018 for additional conditions that must be met before personal data may be transferred to a third country (in particular, that the transfer must be necessary for any of the law enforcement purposes).

(6) Where personal data within subsection (1) is transferred to a third country, the person making the transfer must make it a condition of the transfer that the data may be used only for the purpose for which it is being transferred.

(7) In this section—

• “personal data” has the same meaning as in the Data Protection Act 2018 (see section 3(2) of that Act);

• “third country” means a country or territory other than—

  (a)

  the United Kingdom, or

  (b)

  a member State.