Part 3: Law enforcement processing Chapter 5: Transfers of personal data to third countries etc Sections 73 to 76: General principles for transfers
Section 73 requires any transfers of data to satisfy the conditions set out in subsections (2) to (4). Condition two relates to the standards of data protection in the recipient third country or international organisation. The European Commission will decide, with effect for the entire EU, that certain third countries, a territory or one or more specified sectors within a third country, or an international organisation, offer an adequate level of data protection, thus providing legal certainty and uniformity throughout the EU as regards the third countries or international organisations which are considered to provide such a level of protection. In such cases, transfers of personal data to those countries should be able to take place without the need to obtain any specific authorisation, except where another Member State from which the data were obtained has to give its authorisation to the transfer. As of May 2018, the Commission has adopted 12 adequacy decisions with: Andorra, Argentina, Canada (for transfers to commercial organisations who are subject to the Canadian Personal information Protection and electronic Documents Act), the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, and the United States (for certified companies).
	The European Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation, no longer ensures an adequate level of data protection. Consequently, the transfer of personal data to that third country or international organisation should be prohibited unless the requirements of section 75 or 76, which govern transfers based on appropriate safeguards and specific circumstances, are fulfilled.
	Transfers not based on such an adequacy decision are allowed only where appropriate safeguards have been provided in a legally binding instrument (for example, a bilateral agreement between the UK and a third country) which ensures the protection of personal data or where the controller has assessed all the circumstances surrounding transfers of that type of data and, on the basis of that assessment, considers that appropriate safeguards with regard to the protection of personal data exist. Controllers are able to take into account cooperation agreements concluded between Europol or Eurojust and third countries which allow for the exchange of personal data when carrying out the assessment of all the circumstances surrounding the data transfer. A controller may also take into account the fact that the transfer of personal data will be subject to confidentiality obligations and the principle of specificity, ensuring that the data will not be processed for other purposes than for the purposes of the transfer. In addition, a controller should take into account that the personal data will not be used to request, hand down or execute a death penalty or any form of cruel and inhuman treatment. While those conditions could be considered to be appropriate safeguards allowing the transfer of data, a controller should be able to require additional safeguards.
	Where no adequacy decision or appropriate safeguards exist, section 76 provides that a transfer or a category of transfers could take place in specific situations, if necessary to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject; for the prevention of an immediate and serious threat to the public security of a Member State or a third country; in an individual case for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or in an individual case a legal purpose, including the establishment, exercise or defence of legal claims. Such transfers should be documented and should be made available to the Commissioner on request in order to monitor the lawfulness of the transfer.