(1) Personal data may be transferred in accordance with section 96(1) to a third country, a territory or sector thereof, or an international organisation, in respect of which a decision has not been taken by the European Commission under Article 36 of the Directive that the third country, territory or sector thereof, or the international organisation, as the case may be, ensures an adequate level of protection of personal data, where -

(a) there is a legally binding instrument that applies to the transfer and that ensures appropriate safeguards with regard to the processing of personal data, or

(b) the controller transferring the personal data, or on whose behalf the personal data are being transferred, has -

(i) assessed all the circumstances relating to the transfer, and

(ii) is satisfied that appropriate safeguards exist with regard to the protection of the personal data.