3400 GOVERNMENT GAZETTE of such rights and legitimate interests of the data subject on the basis of whether the recipient of the personal data in the third country ensures in this case their appropriate protection. 3. Where personal data transferred or made available from another Member State of the European Union must be transferred in accordance with paragraph 1, the competent authority of the other Member State must have first given its authorisation to such transfer. Transfers without prior authorisation shall be permitted only where the transfer is necessary for the prevention of an immediate and serious risk to public security of a State or to essential interests of a Member State and the prior authorisation cannot be obtained in a timely manner. In the case of paragraph 2, the authority or body of the other Member State responsible for giving authorisation shall be informed of the transfer immediately. 4. The controller transferring personal data pursuant to paragraph 1 shall take appropriate measures to ensure that the recipient transmits only the data transmitted to other third countries or international organisations, where the controller has given prior authorisation to such transfer. Where the controller decides to give authorisation, the controller shall take due account of all relevant factors, in particular the seriousness of the offence, the purpose for which the data were originally transferred, and the level of personal data protection in the third country or international organisation to which personal data are to be transferred. An authorisation may be given only if it is permitted to transfer personal data directly to another third country or international organisation. Article 76 Transfers subject to appropriate safeguards (Article 37 of the Directive) 1. In the absence of an adequacy decision pursuant to subparagraph (b) of paragraph 1 of the previous Article, a transfer of personal data to a third country or an international organisation may take place where: (a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument, or (b) the controller has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with regard to the protection of personal data. 2. The controller shall record the transfers under indent (b) of paragraph 1. The recording shall include the date and time of the transfer, the identity of the recipient, the justification for the transfer and the personal data transferred. The above recording shall be made available to the Authority upon request. Article 77 Derogations for specific situations (Article 38 of the Directive) 1. In the absence of an adequacy decision pursuant to Article 75(1)(b), or of appropriate safeguards pursuant to paragraph 1 of the previous Article, transfers meeting the other conditions of Article 75 may take place only on the A’ 137/29.08.2019 condition that this is necessary in order to: (a) protect the vital interests of the data subject or another person, (b) safeguard legitimate interests of the data subject, (c) prevent an immediate and serious threat to public security of a country, (d) in individual cases for the purposes set out in Article 43, or (e) in individual cases for the establishment, exercise or defence of legal claims relating to the purposes set out in Article 43. 2. The transfer of personal data pursuant to the previous paragraph shall not be permitted, where the transferring competent authority determines that the data subject’s fundamental rights and legitimate interests override the public interest in the transfer. 3. Paragraph 2 of the previous Article shall apply accordingly to the transfers referred to in paragraph 1. Article 78 Transfers of personal data to recipients established in third countries (Article 39 of the Directive) 1. In specific individual cases, and if all other requirements for data transfers to third countries are fulfilled, controllers may transfer personal data directly to recipients established in third countries not referred to in indent (a) of Article 75(1), if the transfer is strictly necessary for the performance of their tasks, and (a) in this case, no fundamental right of the data subject overrides the public interest necessitating the transfer, (b) the transfer to the authorities referred to in in Article 75(1)(a) is ineffective or inappropriate, in particular because the transfer cannot be achieved in a timely manner, and (c) the controller informs the recipient of the purposes of the processing and gives clear instructions to the recipient that the transmitted data may be processed only to the extent necessary for such purposes. 2. In the case of paragraph 1, the controller shall inform without delay the authorities referred to in indent (a) of Article 75(1), unless that is ineffective or inappropriate. 3. Paragraphs 2 and 3 of Article 75 shall apply accordingly to transfers in accordance with paragraph 1. 4. In the case of transfers referred to in paragraph 1, the controller shall oblige the recipient to process the personal data transferred without the consent of the controller only for the purpose for which the data were transmitted. 5. Agreements in the field of judicial cooperation in criminal matters and police cooperation shall remain unaffected. SECTION VI COOPERATION AUTHORITIES BETWEEN SUPERVISORY Article 79 Mutual assistance (Article 50 of the Directive) 1. The Authority shall provide the supervisory authorities of other Member States with information and mutual