Policy paper

Consulation response to the international transfer of personal information consultation

Published 26 February 2026

Consultation questions from the IOC

What is the name of your organisation?

Office of the Biometrics and Surveillance Camera Commissioner

We may wish to contact you to discuss some of the points you’ve raised or to invite you to participate in any future workshops. If you’re happy for us to do this, please provide your name and a contact email address.

Professor William Webster
Biometrics and Surveillance Camera Commissioner
enquiries@obscc.org.uk

What impact will this guidance have on you and your organisation’s level of knowledge and awareness of international transfers under part 3?

As Biometrics and Surveillance Camera Commissioner, I oversee the retention and use of biometrics by police in the UK, and the use of open space surveillance cameras by relevant authorities.

The exponential development of biometric and surveillance technology has a direct impact on the use of personal data, and I am grateful for the opportunity to review and comment on the ICO’s draft guidance on Part 3 international transfers, which has clear links to my oversight role.

As the Home Office brings to a close its own consultation on a new legal framework for the use of biometrics, facial recognition and similar technologies, which importantly also asks what oversight of these capabilities might look like in the future, understanding how the ICO’s regulatory role and that of a new regulator fit seamlessly will be an important step in ensuring guidance documents published in this field continue to be complementary.

This draft guidance clearly sets out the requirements for Part 3 international transfers and ICO’s role, and I welcome its publication.

Did you find it easy to understand the requirements and our expectations of international transfers under part 3?

Yes

Did you find the content structured in a clear way?

Yes

Please tell us what you liked about the guidance.

The guidance is somewhat simple to follow, although there is a lot of information to take in (see comments below).  

Please tell us what you think can be improved in the guidance.

Useful for the guidance to explicitly state that relevant guidance may have been issued by other organisations that should also be considered when undertaking these transfers, particularly where there is legislation other than the Data (Use and Access) Act which might apply. For instance, in the ‘About this Guidance’ section, as currently drafted, it could be interpreted that only ICO guidance should be followed.

Some of the processes are quite technical and there is a lot of text. It may be worth considering an alternative way of communicating some elements, such as flow charts.

Do you think the examples we’ve provided are helpful?

Yes

If you answered “No” or “Not sure”, please tell us why.

N/A

If you have any specific examples that you think would be appropriate for the guidance to cover, please outline them below. We’ve included blank example boxes in the draft guidance to indicate where we’d particularly welcome your scenarios.

N/A

Thinking about the Part 3 TRA approach set out in our guidance, do you have any suggestions or comments? For example, are there parts of the TRA you find easier or more difficult to complete?

N/A

The guidance uses the term ‘competent authority assessment’ to refer to when the competent authority must complete a TRA to ensure the standard of protection will not be materially lower in the destination country for people whose personal information you want to transfer. This is one of the appropriate safeguards under part 3. We’d welcome your views on whether this approach is clear and helpful.

Unless you are familiar with the guidance, it’s not immediately clear that the term refers to an assessment of the recipient, and reads more like it’s the competent authority that is being assessed, rather than it doing the assessing.

Do you have any other suggestions, which haven’t been captured in the previous questions, for what the ICO’s updated guidance on international transfers under part 3 could cover or clarify for you?

I welcome this guidance issued by the ICO, as a useful tool for practitioners.

Professor William Webster

Biometrics and Surveillance Camera Commissioner

18 February 2026