(1) A controller may not transfer personal data to a third country or to an international organisation unless -
(a) the three conditions set out in subsections (2) to (4) are met, and
(b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State.
(2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes.
(3) Condition 2 is that the transfer -
(a) is based on adequacy regulations (see section 74A),
(b) if not based on adequacy regulations, is based on there being appropriate safeguards (see section 75), or
(c) if not based on adequacy regulations or on there being appropriate safeguards, is based on special circumstances (see section 76).
(4) Co
…