Data Protection Principle 8 - Transfers Abroad

This Principle restricts the transfer of personal data from the UK to either

• member states of the European Economic Area, i.e. the 25 members of the European Union, plus Iceland, Liechtenstein and Norway, or
  
  
• countries that have equivalent data protection legislation, currently Argentina, Canada, Switzerland, Guernsey, Isle of Man, and US-based organisations adhering to the US Safe Harbor Privacy Principles.

Where this Principle creates difficulties for data controllers wishing to transfer certain kinds of personal data to countries that do not have equivalent protection, the European Commission has issued standard contractual clauses which may be used by data controllers to fulfil the requirements of the Directive.

However, exemptions are defined in Schedule 4 of the DPA that allow the transfer of personal data to other countries where the transfer is necessary

• for the performance of a contract between the data subject and the data controller, or
• for the taking of steps at the request of the data subject with a view to his entering into a contract with the data controller.

There is not, therefore, any difficulty in sending payment information to the countries in which expatriates are working so that they can be paid, or for employment information to be transferred between a head office in the UK and branch offices abroad.