27.—(1) In this Part—
“the Act” means the Data Protection Act 1998(1);
“the Commissioner” means the Information Commissioner established by section 6 of the Act (the Commissioner);
“data” and “data subject” have the meanings given by section 1 of the Act (basic interpretative provisions);
“the Data Protection Framework Decision” means Council Framework Decision 2008/977/JHA of 27th November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters(2);
“Member State” means an EEA State;
“non-UK competent authority” means—
any of the police, customs, judicial or other competent authorities of a Member State other than the United Kingdom authorised by that State’s national law to process personal data within the scope of the Data Protection Framework Decision; and
an agency or other body established by a legal instrument adopted under Title VI of the Treaty on European Union (as it had effect before 1st December 2009) or Chapter 1, 4 or 5 of Title V of Part Three of the Treaty on the Functioning of the European Union that is not in the UK;
“personal data” has the meaning given by section 1 of the Act;
“the relevant conditions” has the meaning given by section 33(1) of the Act (research, history and statistics);
“sensitive personal data” has the meaning given by section 2 of the Act (sensitive personal data); and
“UK competent authority” means an authority referred to in Schedule 4.
(2) Other expressions used in this Part which are defined in the Data Protection Framework Decision have the same meaning as in that Decision.
28.—(1) Subject to paragraph (3), this Part applies in relation to the processing of personal data by a UK competent authority which is carried out—
(a)for the purposes of the prevention, investigation, detection or prosecution of a criminal offence or the execution of a criminal penalty;
(b)in the circumstances set out in paragraph (2); and
(c)in the course of activities within the scope of a relevant EU measure.
(2) The circumstances are that the processing of personal data is or has been transmitted or made available—
(a)between Member States;
(b)to an authority or information system established on the basis of Title VI of the Treaty on European Union (as it had effect before 1st December 2009) or Chapter 1, 4 or 5 of Title V of Part Three of the Treaty on the Functioning of the European Union; or
(c)to a UK competent authority by an authority or information system established on the basis of Title VI of the Treaty on European Union (as it had effect before 1st December 2009) or Chapter 1, 4 or 5 of Title V of Part Three of the Treaty on the Functioning of the European Union.
(3) This Part does not apply to the processing of personal data transmitted to or made available to a UK competent authority that is subject to the Data Protection Framework Decision if those data originated in the United Kingdom.
(4) In this regulation, a relevant EU measure is—
(a)any measure adopted under Chapter 4 (judicial cooperation in criminal matters) or Chapter 5 (police cooperation) of Title V of Part Three of the Treaty on the Functioning of the European Union which binds the United Kingdom;
(b)any act of the Union in the field of police cooperation and judicial cooperation in criminal matters adopted on the basis of Title V or VI of the Treaty on European Union prior to the entry into force of the Treaty of Lisbon in which the UK participates by virtue of Title VII of Protocol 36 (transitional provisions) to the EU Treaties.
OJ No. L 350, 30.12.2008, p. 60.