Data Protection Act 2018
|
Derogations for specific situations | ||
|
99. (1) Where section 97 or 98 does not apply in relation to a transfer of personal data to a third country or an international organisation, personal data may be transferred in accordance with section 96 (1) to the third country or the international organisation, where the transfer is necessary— | ||
(a) to protect the vital interests of the data subject or another individual, | ||
(b) to safeguard the legitimate interests of a data subject, | ||
(c) for the prevention of an immediate and serious threat to public security in a Member State or a third country, | ||
(d) subject to subsection (2), in an individual case, for a purpose specified in section 70 (1)(a), or | ||
(e) subject to subsection (2), in an individual case, for the establishment, exercise or defence of legal claims relating to a purpose specified in section 70 (1)(a). | ||
(2) Paragraphs (d) and (e) of subsection (1) shall not apply where the controller transferring the personal data, or on whose behalf the personal data are being transferred, is of the opinion that the rights and freedoms of the data subject override the public interest in the transfer concerned. | ||
(3) Where personal data are transferred to a third country or an international organisation pursuant to subsection (1), the controller transferring the personal data, or on whose behalf the personal data are being transferred, shall create and maintain a record in writing of each such transfer containing at least the following: | ||
(a) details of the personal data transferred; | ||
(b) the date and the time of the transfer; | ||
(c) information about the controller in the third country or the international organisation to which the data were transferred; | ||
(d) the reasons for the transfer. | ||
(4) A controller shall make available a record created and maintained pursuant to subsection (3) to the Commission for inspection upon a request in that regard by the Commission. |