(1) Personal data may be transferred in accordance with section 96(1), subject to subsection (2), to a third country or an international organisation where a decision has been taken by the European Commission under Article 36 of the Directive that the third country or the international organisation, as the case may be, ensures an adequate level of protection of personal data.

(2) Where the European Commission has taken a decision under Article 36 of the Directive that applies to a specified territory within a third country or a specified sector in a third country, personal data may be transferred under subsection (1) to a controller in the specified territory or sector only, as the case may be.