# The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, Regulation 38: Processing of personal data received from or made available by an authority in another Member State


(1) A UK competent authority may only process personal data received from or made available by a non-UK competent authority for the purpose for which they were transmitted or made available, or for any of the following purposes—
(a) the prevention, investigation, detection or prosecution of a criminal offence, or the execution of a criminal penalty, other than that for which the data were transmitted or made available;
(b) other judicial and administrative proceedings directly linked to the prevention, investigation, detection or prosecution of a criminal offence or execution of a criminal penalty;
(c) prevention of an immediate and serious threat to public security;
(d) any other purpose only with the prior consent of the transmitting authority or the data subject’s consent given in accordance with national law.
(2) A UK competent authority may undertake further processing of personal data for historical, statistical or scientific purposes if the relevant conditions are complied with.
(3) When undertaking further processing for historical, statistical or scientific purposes, consideration must be given to whether the purpose can be achieved by making the data anonymous.

---
Source: https://www.legislation.gov.uk/ukdsi/2014/9780111122723/regulation/38 (the official version)
Page: https://openlegislation.uk/draft-criminal-justice-and-data-protection-protocol-no-36-regulations-2014/regulation-38
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.