Part 3: Law enforcement processing Chapter 5: Transfers of personal data to third countries etc Section 78: Subsequent transfers
Where personal data is transferred from the UK to third countries or international organisations, any subsequent transfer should, in principle, take place only after the competent authority from which the data was obtained has given its authorisation to the transfer. Onward transfers of personal data should be subject to prior authorisation by the competent authority that carried out the original transfer (the original transfer should provide the recipient with any specific handling conditions). When deciding on a request for the authorisation of an onward transfer, the competent authority that carried out the original transfer should take due account of all relevant factors, including the seriousness of the criminal offence, the specific conditions subject to which, and the purpose for which, the data was originally transferred, the nature and conditions of the execution of the criminal penalty, and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred. The competent authority that carried out the original transfer should also be able to subject the onward transfer to specific conditions. Such specific conditions can be described, for example, in handling codes.