Article 17a (transfers to third countries)

• 1

  Police data may, subject to the provisions of or pursuant to this Act, be transferred to a controller in a third country or to an international organization to the extent that this is necessary for the purposes referred to in Section 1(a) and if the Commission of the European Union has decided that the third country or international organization ensures an adequate level of protection for the intended data processing.

• 2

  In the absence of a decision of the Commission referred to in paragraph 1, police data may be provided or transmitted if:

  • a.

    appropriate safeguards for the protection of personal data have been provided in a legally binding instrument; or

  • b.

    the controller has concluded, after assessing all the circumstances, that the third country or international organization provides adequate safeguards for the protection of personal data. The controller shall inform the Autoriteit persoonsgegevens of the categories of transfers under this section.

• 3

  In the absence of a Commission decision referred to in the first paragraph or of appropriate safeguards referred to in the second paragraph, a transfer or category of transfers of police data to a third country or international organization shall be authorized only if the transfer is necessary:

  • a.

    to protect a vital interest of the data subject or another person;

  • b.

    is to protect the legitimate interests of the data subject, where the law of the Member State from which the transfer of police data takes place so provides;

  • c.

    is to prevent an immediate and serious danger to the public security of a member state or third country;

  • d.

    in individual cases for the purpose of carrying out the task referred to in Article 1(a);

  • e.

    in individual cases for the purpose of instituting, exercising or defending legal actions in connection with the performance of the task referred to in Article 1(a),

  and the fundamental rights and freedoms of the data subject do not override the public interest in the transfer referred to in subsections d and e.

• 4

  Notwithstanding these paragraphs, where the transfer referred to in paragraphs 1, 2 and 3, and without prejudice to an international agreement between Member States and third countries, involves police data originating from another Member State, the consent of the competent authority of that Member State shall be required for the transfer, unless the transfer is necessary for the prevention of an immediate and serious threat to public security of a Member State or a third country or to fundamental interests of a Member State and prior consent cannot be obtained in a timely manner. The authority responsible for giving prior consent shall be notified without delay.

• 5

  Notwithstanding the first, second and third paragraphs, and without prejudice to any bilateral or multilateral international agreement in force between Member States and third countries in the field of judicial cooperation in criminal matters and police cooperation, police data may, in individual and specific cases, be transferred to a recipient in a third country, without the intervention of a competent authority in that country, if the transfer is strictly necessary for the performance of the task referred to in Article 1, paragraph a, and if the following conditions are met:

  • a.

    the transfer is strictly necessary for the performance of a task defined by Union or Member State law of the competent authority making the transfer for the purposes set out in Article 1(1) of the Directive;

  • b.

    the competent authority making the transfer determines that no fundamental rights and freedoms of the data subject outweigh the public interest in making the transfer necessary in that particular case;

  • c.

    the competent authority making the transfer considers that the transfer to an authority having jurisdiction in the third country for the purposes referred to in Article 1(1) of the Directive is ineffective or inappropriate, in particular because the transfer cannot be effected in a timely manner;

  • d.

    the authority competent in the third country for the purposes referred to in Article 1(1) of the Directive shall be notified without undue delay, unless this is ineffective or inappropriate;

  • e.

    the competent authority making the transfer shall inform the recipient of the specified purpose or purposes for which the personal data may be processed exclusively by the latter, provided that such processing is necessary.

• 6

  Police data may be further transferred by a third country or international organization to another third country or international organization if the competent authority authorizes such further transfer, after duly considering all relevant factors, including the seriousness of the offence, the purpose for which the data were originally transferred and the level of data protection in the third country or international organization to which the personal data are further transferred.

• 7

  By general order in council, further rules shall be laid down on the transmission of police data referred to in paragraphs 1, 2, 3 and 6, as well as on the further processing and the conditions to be imposed thereby on their use by receiving authorities or international bodies, and on the reception of police data from third countries.