(1) This Part applies, subject to subsection (2), to the processing of personal data by or on behalf of a controller where the processing is carried out -

(a) for the purposes of -

(i) the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against, and the prevention of, threats to public security, or

(ii) the execution of criminal penalties,

and

(b) by means that -

(i) are wholly or partly automated, or

(ii) where the personal data form part of, or are intended to form part of, a relevant filing system, are not automated.

(2) This Part shall not apply to the processing of personal data -

(a) that occurs in the course of an activity falling outside the scope of the law of the European Union,

(b) by an institution, body, office or agency of the European Union, or

(c) to which section 8(1)(b) applies.