Commentary on provisions of Act Section 3: Transfers to third countries of personal data notified under section 2
This section introduces rules about the circumstances in which personal data notified by an EU Member State may be sent to a country outside of the EU (a third country).
	Subsection (1) provides that personal data notified by an EU Member State may not be disclosed to a third country unless certain conditions are met.
	Subsection (2) sets out condition A: that the transfer must be based on data adequacy regulations or the existence of appropriate safeguards.
	Subsection (3) provides that subsection (2) is to be interpreted in accordance with the definitions of "adequacy regulations" and "appropriate safeguards" provided for in the Data Protection Act 2018.
	Subsection (4) sets out condition B: that the intended recipient in the third country has functions relating to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.
	Subsection (5) clarifies that this section should be read in conjunction with section 73 of the Data Protection Act 2018 which sets out additional conditions that must be met before personal data can be transferred to a third country. For example, the Data Protection Act 2018 provides that the transfer be required for law enforcement purposes and that permission may be needed from the State who provided the data before it can be sent.
	Subsection (6) places a duty on the person making the transfer to impose a condition that the data may be used only for the purpose for which it is being transferred.
	Subsection (7) defines "personal data" in accordance with its meaning in the Data Protection Act 2018 and "third country" as meaning a country or territory other than the United Kingdom or an EU Member State.