Data Protection Act, 1988
Prohibition on transfer of personal data outside State.
11.—(1) The Commissioner may, subject to the provisions of this section, prohibit the transfer of personal data from the State to a place outside the State.
(2) The Commissioner, when considering whether to prohibit a proposed transfer of personal data from the State to a place in a state bound by the Convention, shall have regard to the provisions of Article 12 of the Convention.
(3) The Commissioner shall not prohibit a proposed transfer of personal data from the State to a place outside the State unless he is of opinion that the transfer would, if the place were in a state bound by the Convention, be likely to lead to a contravention of the basic principles for data protection set out in Chapter II of the Convention.
(4) In determining whether to prohibit a transfer of personal data under this section, the Commissioner shall also consider whether the transfer would be likely to cause damage or distress to any person and have regard to the desirability of facilitating international transfers of data.
(5) A prohibition under subsection (1) of this section shall be effected by the service of a notice (referred to in this Act as a prohibition notice) on the person proposing to transfer the data concerned.
(6) A prohibition notice shall—
(a) prohibit the transfer concerned either absolutely or until the person aforesaid has taken such steps as are specified in the notice for protecting the interests of the data subjects concerned,
(b) specify the time when it is to take effect,
(c) specify the grounds for the prohibition, and
(d) subject to subsection (8) of this section, state that the person concerned may appeal to the Court under section 26 of this Act against the prohibition specified in the notice within 21 days from the service of the notice on him.
(7) Subject to subsection (8) of this section, the time specified in a prohibition notice for compliance with the prohibition specified therein shall not be expressed to expire before the end of the period of 21 days specified in subsection (6) (d) of this section and, if an appeal is brought against the prohibition, the prohibition need not be complied with and subsection (13) of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(8) If the Commissioner—
(a) by reason of special circumstances, is of opinion that a prohibition specified in a prohibition notice should be complied with urgently, and
(b) includes a statement to that effect in the notice,
subsections (6) (d) and (7) of this section shall not apply in relation to the notice but the notice shall contain a statement of the effect of the provisions of section 26 (other than subsection (3)) of this Act and shall not require compliance with the prohibition before the end of the period of 7 days beginning on the date on which the notice is served.
(9) The Commissioner may cancel a prohibition notice and, if he does so, shall notify in writing the person on whom it was served accordingly.
(10) This section shall not apply to a transfer of data if the transfer of the data or the information constituting the data is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the State.
(11) For the purposes of this section, a place shall be deemed to be in a state bound by the Convention if it is in any territory in respect of which the state is so bound.
(12) (a) This section applies, with any necessary modifications, to a transfer of information from the State to a place outside the State for conversion into personal data as it applies to a transfer of personal data from the State to such a place.
(b) In paragraph (a) of this subsection “information” means information (not being data) relating to a living individual who can be identified from it.
(13) A person who, without reasonable excuse, fails or refuses to comply with a prohibition specified in a prohibition notice shall be guilty of an offence.