Schedules Schedule 8: Transfers of personal data to third countries etc: law enforcement processing
Chapter 5 of Part 3 of the DPA 2018 sets out the conditions under which personal data can be transferred by a competent authority, to a country outside of the UK or an international organisation, for law enforcement purposes. Schedule 8 makes various amendments to Chapter 5, to reform the UK’s regime for international transfers for law enforcement purposes, as explained below.
	Paragraph 2 of Schedule 8 amends section 72(1)(b) of the DPA 2018, by substituting "special conditions that apply" with "additional conditions that apply in certain cases" and by referencing section 73(4)(b). These changes are relevant to amendments made to section 73(4)(b) and section 77.
	Paragraph 3 amends section 73 of the DPA 2018, which provides that a controller may only make a transfer of personal data if the conditions of the section are met. The general conditions for transfer remain broadly the same, with minor and technical amendments made to provide greater clarity. There will continue to be an exception to this principle provided in subsection (5), which, as amended, will enable the controller to transfer personal data without prior authorisation where necessary to prevent an immediate and serious threat to public or national security, or essential interests of a third country or the UK, and where the authorisation cannot be obtained in good time. In such circumstances, the controller must notify the overseas authoriser as soon as reasonably practicable.
	Paragraph 3(5) amends condition 3 in section 73(4) by expanding the list of intended recipients to specifically include processors acting on behalf of, and in accordance with a contract with, a controller. The controller may satisfy its obligation to ensure that condition 3 is met in respect of transfers, including onward transfers, made by a processor, where those transfers are governed by a contract imposing binding obligations on a processor in accordance with section 59 of the DPA 2018. Whilst transfers to processors in third countries are currently permissible, this amendment clarifies the existing law and section 73(4)(aa) provides legal certainty to UK controllers that they, and any processors appointed by them, can transfer personal data to their processors, and sub-processors, operating outside of the UK.
	Paragraph 4(1) omits section 74A. Previously that section provided that transfers of personal data to another country could take place where the Secretary of State had made regulations finding that the country in question provided an adequate level of protection. The free flow of personal data for law enforcement purposes would then be allowed to that country. In place of section 74A there is new section 74AA and 74AB, with amendments also made to 74B. These changes mirror those made to the equivalent provisions under the UK GDPR, in the new Articles 45A, 45B and 45C, detailed in the notes relating to Schedule 7 above, so reference should be made to those notes if a more detailed explanation on the effect of these provisions is required.
	Section 74AA(1) provides a power for the Secretary of State to make regulations approving transfers of personal data to a third country or international organisation, thus allowing the free flow of personal data to that country or international organisation, as with the previous power to make adequacy regulations which was dealt with in section 74A of the DPA 2018. Where such regulations are in place, competent authorities will not require any further data protection safeguards to make a transfer of personal data to that country or international organisation, provided the transfer falls within the terms of the regulations.
	Section 74AB sets out the data protection test which the Secretary of State must be satisfied is met in order to make regulations approving transfers to a country or international organisation. Section 74AB(1) provides that the data protection test is met if the standard of protection provided to data subjects with regard to law enforcement processing of personal data in that country or international organisation, is not materially lower than the standard of protection under Part 3 of DPA 2018 and relevant provisions in Parts 5 – 7 of that Act.
	Section 74AB(2) sets out a list of considerations that the Secretary of State must take into account when considering whether the data protection test is met. This is a non-exhaustive list and the Secretary of State may also need to consider other matters in order to determine whether the required standard of protection exists.
	Paragraph 5 of Schedule 8 amends section 74B of the DPA 2018, omitting section 74B(1) and (2). Section 74B will require the Secretary of State to monitor developments in third countries and international organisations that could affect decisions to make regulations approving transfers of personal data under section 74AA, or decisions to amend or revoke such regulations. Ongoing monitoring of countries' relevant laws and practices, will enable the Secretary of State to respond to any developments that might affect decisions to make, amend or revoke regulations under section 74AA. The approach for monitoring may include, for example: dialogue with country representatives; information from HMG Embassies or High Commissions; and engagement with the Information Commissioner. Section 74B(4), as amended, sets out the actions the Secretary of State must take if the data protection test is no longer met in relation to transfers approved, or of a description approved, in regulations under section 74AA. The Secretary of State must, to the extent necessary, either amend or revoke a regulation if the data protection test is no longer met. For example, an amendment may limit the types of transfer that are permitted by the regulation. If there is no way of amending the regulation to meet the data protection test the Secretary of State must revoke it.
	Paragraph 6 of Schedule 8 amends section 75 of the DPA 2018, which provides that transfers of personal data to third countries and jurisdictions can take place where appropriate safeguards are in place to protect that personal data. Paragraph 6 introduces new subsections to this provision.
	Paragraphs 6(1) and 6(2) are self-explanatory.
	Paragraph 6(3) omits existing section 75(1), which currently sets out that transfers are based on appropriate safeguards where a legally binding instrument containing appropriate safeguards binds the recipient or where the controller, after assessing the circumstances surrounding the transfer, concludes that appropriate safeguards exist. Paragraph 6(4) inserts new section 75(1A) and provides that a transfer of personal data is made to a third country or international organisation subject to appropriate safeguards only if:
An appropriate legal instrument binds the intended recipient of the data (subject to new subsection (4)). This provision replicates the previous section 75(1)(a);
Or (b)) the controller, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or that type of transfer (subject to subsection (5)). This provision essentially replaces the previous section 75(1)(b);
	Paragraphs 6(5) and 6(6) make amendments to existing section 75(2) and 75(3), which provide further detail on controllers’ obligations when relying on transfers subject to appropriate safeguards. These provisions remain largely unchanged with minor amendments to reflect the wider changes. The amendment to section 75(2) means that Controllers will still be required to inform the Commissioner of the categories of data to be transferred where the controller determination mechanism is relied upon), except where the transfer is to a processor pursuant to the new section 73(4)(aa). This does not require controllers to notify the Commissioner on each occasion data is transferred; it simply requires notification of the categories of information that can take place relying on section 75(1A)(b).
	Paragraph 6(7) adds new sections 75(4), 75(5), 75(6) and 76(7).
	Paragraph 6(7) inserts a new section 75(4) which sets out the circumstances for when a legal instrument is ‘appropriate’, for the purposes of 75(1A)(a). The instrument must (a) be intended to be relied on in connection with the transfer or that type of transfer, (b) have at least one competent authority as a party to it and (c) each competent authority that is a party to it, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfers, or types of transfer, intended to be made in reliance on the instrument (subject to subsection (5)). In practice, ‘appropriate legal instruments’ are likely to be agreed by government departments with their counterparts in third countries, and that department would need to take reasonable and proportionate steps to ensure the data protection test is met. Where such instruments are in place, the Controller (assuming this is a separate entity to the party that created it) will need to ensure the data they wish to transfer is within scope of the instrument.
	Paragraph 6(7) introduces the new data protection test in new section 75(5), which the controller or competent authority, which is party to an instrument must, acting reasonably and proportionately consider is met before a transfer under section 75 may take place. The data protection test is met, in relation to a transfer, or a type of transfer, of personal data if, after the personal data being transferred has reached its destination, the standard of protection provided for the data subject with regard to that personal data, whether by a binding legal instrument or by other means, would not be materially lower than the standard of the protection provided under Part 3 of the DPA 2018 and Parts 5 to 7 of the Act so far as they relate to processing by a competent authority for any of the law enforcement purposes, in a way that is material. This includes relevant enforceable data subject rights and effective legal remedies for the data subject in all the circumstances of the transfer. The new test also recognises that safeguards may be applied in different cultural and legal contexts when being used internationally and still provide appropriate protection for data subjects, and is consistent with the approach taken in the new section 74AB. The reference to "other means" should be understood as anything other than a legal instrument which ensures the standard of protection and may include, for example, a situation when standard of protection is provided in the domestic laws and practices of a third country, whereby those laws would be the "other means" of protection. The test therefore does not require a point-by-point replication of protections for data subjects, which would not be reasonable or proportionate given the ways in which data protection regimes may differ.
	Paragraph 6(7) introduces new section 75(6), which provides more detail about what it means to act reasonably and proportionately. It clarifies that the actions of a controller or a competent authority that is party to an instrument must be reasonable and proportionate in all the circumstances (or likely circumstances) of the transfer (or types of transfer) - this includes considering the nature and volume of the personal data being transferred. For example, a controller seeking to rely on the new section 75(1A)(b), is likely to have a different judgement of what is reasonable and proportionate depending on the specific transfer. If the controller seeks to transfer larger volumes of data on a more frequent basis to a specific third country, what is reasonable and proportionate is likely to be different to a more infrequent transfer. In relation to the former, the Controller may consider, for example, that it is reasonable and proportionate to establish a Memorandum of Understanding with their international counterpart to govern data transfers. which could demonstrate the steps the controller had taken, and assurances received, to ensure the protection of personal data. This process is distinct to that which the Secretary of State undertakes under new sections 74AA and 74AB. It is tailored for the purposes of controllers or competent authorities that are parties to an instrument.
	Paragraph 6(7) introduces new section 75(7), which clarifies that references to the protection for the data subject are to that protection taken as a whole.
	Paragraph 7 amends section 76 of the DPA 2018, which provides for when data can be transferred to a third country or international organisation in the absence of ‘adequacy regulations’ and ‘appropriate safeguards’, where it is necessary for a special purpose.
	Paragraph 7(4)(b) amends section 76(1)(c) to include reference to national security in addition to public security while also adding reference to the ‘UK’. These changes ensure that Controllers are confident to transfer data where necessary for the prevention of an immediate and serious threat to national security of the UK or a third country. Paragraph 7(4)(c) and (d) make amendments to section 76(1)(d) and (e), replacing the previous wording of ‘in individual cases’ with ‘in particular circumstances’. This wording better reflects the fact that the law is not seeking to limit transfers by competent authorities to individual pieces of data, making clearer that transfers can take place involving a broader set or category of data in particular circumstances. This clarity is important, as transfers of data may be particularly relevant and necessary as part of operations and investigations that are broad in scope, for example, the pursuit of child sexual abuse networks.
	Paragraph 7(6) inserts a new additional subsection into section 76, which makes clear that controllers transferring data in reliance on section 76 must ensure that the amount of data shared is not excessive in relation to the special purpose for which it is shared. The fact that a transfer of data involves sharing multiple records would not mean that the transfer would be considered excessive, so long as the sharing is necessary and proportionate. For example, during investigations of serious and organised crime, a competent authority may conclude that it is necessary and proportionate to share multiple targeted records with a third country to help further the investigation.
	Paragraph 8 amends the italic heading before section 77 from "Transfers to particular recipients" to "Additional conditions".
	Paragraph 9 amends the heading of section 77 from "Transfers of personal data to persons other than relevant authorities" to "Additional conditions for transfers in reliance on section 73(4)(b)". Paragraphs 9(1) and (2) amend sections 77(6) and (7) to specify that they relate to transfers that take place in reliance on section 73(4)(b).
	Paragraph 10 amends section 78 of the DPA 2018, which provides that where data has been transferred by a competent authority to a third country or international organisation, any subsequent transfers of that data should ordinarily take place only after the competent authority from which the data was obtained has given its authorisation to the transfer.
	Paragraph 10(2) inserts new subsection 78(A1) which clarifies that subsections (1) to (6) apply where transfers are conducted under section 73, except where the transfer is to a processor pursuant to section 73(4)(aa).
	Paragraph 10(3) amends section 78(1) to allow subsequent transfers to be made without authorisation in the exceptional circumstances set out in section 78(1A). Where such transfers are made, the UK authoriser must be informed without delay.
	Paragraph 10(4) inserts new section 78(1A) stipulating that competent authorities transferring data under Part 3 of the DPA 2018 must make it a condition of transfer that either the recipient of the data must seek prior authorisation from the UK authoriser before sharing the data further or alternatively that prior authorisation should be sought, except where the subsequent transfer is necessary to prevent an immediate and serious threat to public security or national security and there being a lack of time to reasonably seek prior authorisation. Such a transfer may occur when, for example, there is an immediate and credible threat to life such as a terrorist attack and the third country concludes that a subsequent transfer of data, originally transferred to them by a UK controller, is needed to prevent it. Where a transfer is made by the third country in such circumstances, they must notify the UK controller of such a transfer having happened as soon as reasonably practicable. It is ultimately up to the UK controller to determine whether to require prior authorisation in all cases or whether the third country should be able to transfer without such authorisation in these limited urgent circumstances.
	Paragraph 10 (7) makes a minor amendment to the wording in section 78(4) but maintains the principle that the UK authoriser may not give permission for a subsequent transfer without the prior authorisation of the EU member State where the data originated. There will continue to be an exception to this principle provided in subsection (5), which, as amended, will enable the controller to transfer personal data without prior authorisation where necessary to prevent an immediate and serious threat to the public or national security, or essential interests of a third country or the UK, and where the authorisation cannot be obtained in good time. In such circumstances, the controller must notify the overseas authoriser as soon as reasonably practicable.
	Paragraph10(8) amends section 78(5)(a) whereby equal consideration is given to the public security, national security or essential interests of both the UK or a third country as valid circumstances in which authorisation is not required.
	Paragraph 10(10) inserts a new section 78(7) which specifies the conditions that controllers must impose when making transfers to processors pursuant to section 73(4)(aa).