# The Criminal Justice and Data Protection (Protocol No. 36) Regulations 2014, Regulation 41: Transmission to private parties


(1) A UK competent authority may transmit to a private party personal data received from or made available to it by a non-UK competent authority only if—
(a) the authority from which the data were obtained has consented in compliance with the applicable national law to its transmission;
(b) no legitimate specific interests of the data subject prevent transmission; and
(c) in the particular case, transmission by the UK competent authority is essential for—
(i) performance of a task lawfully assigned to it;
(ii) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
(iii) prevention of an immediate and serious threat to public security; or
(iv) prevention of serious harm to the rights of individuals.
(2) The UK competent authority transmitting the data to a private party shall inform the private party of the purposes for which the data may exclusively be used.
(3) In this regulation, “private party” does not include a body which exercises functions of a public nature, whether under contract or otherwise, when engaging in an activity that involves the exercise of those functions.

---
Source: https://www.legislation.gov.uk/ukdsi/2014/9780111122723/regulation/41 (the official version)
Page: https://openlegislation.uk/draft-criminal-justice-and-data-protection-protocol-no-36-regulations-2014/regulation-41
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.