Section 78 — Data Protection Act 2018: Subsequent transfers

Subsequent transfers 78 A1 Subsections (1) to (6) apply where a transfer to which section 73 applies takes place otherwise than in reliance on section 73(4)(aa) (transfer to processor). 1 ... The transferring controller must make it a condition of the transfer —

a that the personal data is not to be further transferred to a third country or international organisation without the authorisation of the transferring controller or another competent authority (the “UK authoriser”), or b that—

i the personal data is not to be so transferred without such authorisation except where subsection (1A) applies, and ii where a transfer is made without such authorisation, the UK authoriser must be informed without delay. 1A This subsection applies if—

a the transfer is necessary for the prevention of an immediate and serious threat to the public security or national security of a third country or the United Kingdom, and b authorisation from the UK authoriser cannot be obtained in good time.

2 The UK authoriser may give an authorisation for the purposes of a condition described in subsection (1) only where the further transfer is necessary for a law enforcement purpose.

3 In deciding whether to give the authorisation, the UK authoriser must take into account (among any other relevant factors)—

a the seriousness of the circumstances leading to the request for authorisation, b the purpose for which the personal data was originally transferred, and c the standards for the protection of personal data that apply in the third country or international organisation to which the personal data would be transferred.

4 In a case where the personal data was originally transmitted or otherwise made available to the transferring controller or another competent authority by a member State ..., the UK authoriser may not give an authorisation for the purposes of a condition described in subsection (1) unless that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.

5 Authorisation is not required as mentioned in subsection (4) if—

a the transfer is necessary for the prevention of an immediate and serious threat to the public security, national security or essential interests of a third country or the United Kingdom , and b the authorisation cannot be obtained in good time.

6 Where a transfer is made in a case described in subsection (4) without the authorisation mentioned in that subsection (whether made with or without authorisation from the UK authoriser), the UK authoriser must, without delay, inform , the authority in the member State which would have been responsible for deciding whether to authorise the transfer ....

7 Where a transfer takes place in reliance on section 73(4)(aa) (transfer to processor), the transferring controller must make it a condition of the transfer that the data is only to be further transferred to a third country or international organisation where—

a the terms of any relevant contract entered into, or authorisation given, by the transferring controller in accordance with section 59 are complied with, and b the further transfer satisfies the requirements in section 73(1).