Regulation 41 Transmission to private parties
A UK competent authority may transmit to a private party personal data received from or made available to it by a non-UK competent authority only if—
the authority from which the data were obtained has consented in compliance with the applicable national law to its transmission;
no legitimate specific interests of the data subject prevent transmission; and
in the particular case, transmission by the UK competent authority is essential for—
performance of a task lawfully assigned to it;
the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
prevention of an immediate and serious threat to public security; or
prevention of serious harm to the rights of individuals.
The UK competent authority transmitting the data to a private party shall inform the private party of the purposes for which the data may exclusively be used.
In this regulation, “private party” does not include a body which exercises functions of a public nature, whether under contract or otherwise, when engaging in an activity that involves the exercise of those functions.